Click here to Skip to main content
15,886,110 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi
In the below code, when I run it and input the values as it's in the PostgreSQL database it's showing 'Invalid password' in client's table where it's totally correct.

PHP
<pre><?php
include "dbconn.php";

if (isset($_POST['submit'])) {
    try {
        $cuid = $_POST['username'];
        $cpass = $_POST['password'];

        // Check if username exists in Clients table
        $stmt = $pdo->prepare("SELECT * FROM clients WHERE cuid = :cuid");
        $stmt->execute(array(':cuid' => $cuid));
        $result = $stmt->fetch();

        if ($result) {
            if (password_verify($cpass, $result['cpass'])) {
                header("Location: dashboard.html");
                exit;
            } else {
                echo "Invalid password";
            }
        } else {
            // Check if username exists in SubUser table
            $stmt = $pdo->prepare("SELECT * FROM SubUser WHERE SubUsrID = :cuid");
            $stmt->execute(array(':cuid' => $cuid));
            $result = $stmt->fetch();

            if ($result) {
                if (password_verify($cpass, $result['SubUsrPass1'])) {
                    header("Location: dashboard-Sub.html");
                    exit;
                } else {
                    echo "Invalid password";
                }
            } else {
                // Check if username exists in BervEmp table
                $stmt = $pdo->prepare("SELECT * FROM BervEmp WHERE BerEmpID = :cuid");
                $stmt->execute(array(':cuid' => $cuid));
                $result = $stmt->fetch();

                if ($result) {
                    if (password_verify($cpass, $result['pass'])) {
                        header("Location: empdashboard.html");
                        exit;
                    } else {
                        echo "Invalid password";
                    }
                } else {
                    echo "Invalid username";
                }
            }
        }
    } catch (PDOException $e) {
        echo "Error: " . $e->getMessage();
    }
}
?>


php code of database connection:

PHP
<pre><?php
class Db
{
    private $dsn;
    private $user;
    private $password;
    private $pdo;

    public function __construct($dsn, $user, $password)
    {
        $this->dsn = $dsn;
        $this->user = $user;
        $this->password = $password;
    }

    private function connect()
    {
        try {
            $this->pdo = new PDO($this->dsn, $this->user, $this->password);
        } catch (PDOException $e) {
            echo "Connection failed: " . $e->getMessage();
        }
    }

    public function getPdo()
    {
        if (!$this->pdo) {
            $this->connect();
        }
        return $this->pdo;
    }
}

$dsn = "pgsql:host=localhost;dbname=Beravaa";
$user = "postgres";
$password = "222222";

$db = new Db($dsn, $user, $password);
$pdo = $db->getPdo();

if ($pdo) {
    echo "Connected to the database successfully";
} else {
    echo "Failed to connect to the database";
}
?>


What I have tried:

I tried to change the data type of the column to text, but it's the same.
Posted
Updated 15-Feb-23 0:09am
v2
Comments
Richard MacCutchan 15-Feb-23 4:15am    
It is a simple matter to create a hash of the password field and compare it with the value returned from the database.
Andre Oosthuizen 15-Feb-23 10:11am    
As OriginalGriff pointed out, you need to run your debugger line by line, it will highlight your error for you in VS.

Other than that, your error checking is good, maybe just change the message that you return as they are called the same in 3 IF blocks, this way you will at least know which block throws the error -
echo "Invalid password in my Login";

echo "Invalid password as the User Exist in SubUser Table";

echo "Invalid password as the User Exist in BervEmp Table";

1 solution

How do you know it is correct? What value did you store in the DB? How did you store it? What value is returned by the SELECT? Do the rows even exist? Are you even connected to the correct database?

You need to look at exactly what is happening while your code is running - and we can't do that - we don't have access to your full code or your database and you need both of those to work out where it is going wrong.

So, it's going to be up to you.
Fortunately, you have a tool available to you which will help you find out what is going on: the debugger. How you use it depends on your compiler system, but a quick Google for the name of your IDE and "debugger" should give you the info you need.

Put a breakpoint on the first line in the function, and run your code through the debugger. Then look at your code, and at your data and work out what should happen manually. Then single step each line checking that what you expected to happen is exactly what did. When it isn't, that's when you have a problem, and you can back-track (or run it again and look more closely) to find out why.

Sorry, but we can't do that for you - time for you to learn a new (and very, very useful) skill: debugging!
 
Share this answer
 
Comments
Mohamad Simo 15-Feb-23 6:06am    
Dear OriginalGriff, thanks for your reply, even it seems you're so upset. But i would like to inform you I already know about a tool called debugging which for some reason is not working well on my VS Code. So in case if you see my question is professional enough, you can ignore it and maybe someone else can find a solution for that.
OriginalGriff 15-Feb-23 6:28am    
I'm not upset - I was pointing out questions you need to be asking yourself, and telling you how you you find out the answers.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900