Php Prepared Statement Login

I'm in the process of adding password hashing and SQL injection defenses into my Login system. Currently, I've ran into an error.

Solution 1:

You're doing a SELECT *, and using fetchColumn, so the results are dependent of the returned columns order. You should either select the specific columns you need, or fetch the whole row as an associative array , and access it by column name.

There are other two issues that you should fix:

• You shouldn't be using mysqli_connect_error() as you're using PDO. The right function would be $con->errorInfo().
• You're defining some constants with the connection settings, yet you don't use them on the PDO() call, repeating the values instead.

Solution 2:

Use

// it will be an array('name'=>'John', 'password_hash'=>'abcd')
//orFALSE if usernot found
$storedUser = $query->fetch(PDO::FETCH_ASSOC);

instead of

$username = $query->fetchColumn(1);
$pw = $query->fetchColumn(2);

Because fetchColumn moves cursor of result. So first call extracts 1 column of first row, and second call will extract data from SECOND row!

Share