I am relatively new to MySQL and PHP, so bear with me. The following code:
$query = $pdo->prepare("SELECT `id` FROM `Logins` WHERE `username`=:u AND `hash`=SHA2(CONCAT(salt,:p),512)");
$id = $query->execute([
'u' => $_POST['user'],
'p' => $_POST['pass']
]);
seems to always return 1 for the id, no matter what username or password is put into the form, whether it's valid for id 3 or completely invalid. This makes me think it's an error from MySQL or something, but the above command works when I use it directly in a connection to the MySQL server.
I have verified that the data is correct from the form and PDO doesn't throw any errors with this, so maybe this isn't the code doing it, but I'm not sure what else it could be. The rest of the PHP file is just a login screen html, which has worked in the past, and the stuff to create the connection, which also seems to work.
Thanks in advance.
CodePudding user response:
execute returns true or false signifying whether the query succeeded or not.
In order to get the id back from the query, you'll need to fetch it. E.g.:
$query = $pdo->prepare("SELECT `id` FROM `Logins` WHERE `username`=:u AND `hash`=SHA2(CONCAT(salt,:p),512)");
$success = $query->execute([
'u' => $_POST['user'],
'p' => $_POST['pass']
]);
if ($success) {
$result = $query->fetch(PDO::FETCH_ASSOC);
$id = $result['id'];
}
