PHP $_Session , JS not allowing member login after successful username and password inserted-CodePudding

so, this implementation worked with an md5 password check but after implementing a password hash check (for a safer password storage in my database) the member is not allowed to log in. The user after typing the correct email and password is only brought back to the index.php page. Any help would be appreciated. this is my session.php code:

<?php
 session_start(); 
//Check whether the session variable SESS_MEMBER_ID is present or not
// do check

if(!isset($_SERVER['HTTP_REFERER'])){
    // redirect them to your desired location
    header('Location: custom_404.html');
    exit;
}
if (!isset($_SESSION['alogin']) || (trim($_SESSION['alogin']) == '')) { ?>
<!-- send to home page -->
<script>
window.location = "../index.php";
</script>
<?php
}
$session_id=$_SESSION['alogin'];
$session_depart = $_SESSION['arole'];
?>

here is what should work within index.php:

<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
    $username=$_POST['username'];
    $username=strtolower($username);
    $password=$_POST['password'];

    $sql ="SELECT * FROM tblemployees where EmailId = '$username'";
    $query= mysqli_query($conn, $sql);
    $count = mysqli_num_rows($query);

    if($count>0)
    {
        $passwordCheck = mysqli_fetch_assoc($query)['Password'];
        if(!password_verify($password,$passwordCheck)){
            echo "<script>alert('Wrong password please try again.');</script>";
        }
        while ($row = mysqli_fetch_assoc($query)) {
            if ($row['role'] == 'Admin') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
            }
            elseif ($row['role'] == 'Staff') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
            }
            else {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
            }
        }
    } 
    else{
      
      echo "<script>alert('Wrong email or password please try again.');</script>";

    }

}
// $_SESSION['alogin']=$_POST['username'];
//  echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>

CodePudding user response：

Your login code is wrong. The loop

while ($row = mysqli_fetch_assoc($query))

is never fetching anything, because you already read the row with

$passwordCheck = mysqli_fetch_assoc($query)['Password'];

You should just fetch the row once, and use that for both the password and role checks.

You also should use a prepared statement to prevent SQL injection.

<?php
session_start();
include('includes/config.php');
if(isset($_POST['signin']))
{
    $username=$_POST['username'];
    $username=strtolower($username);
    $password=$_POST['password'];

    $sql ="SELECT * FROM tblemployees where EmailId = ?";
    $stmt= mysqli_prepare($conn, $sql);
    mysqli_stmt_bind_param($stmt, "s", $username);
    mysqli_stmt_execute($stmt);
    $query = mysqli_stmt_get_result($stmt);
    $row = mysqli_fetch_assoc($query);
    if($row)
    {
        $passwordCheck = $row['Password'];
        if(!password_verify($password,$passwordCheck)){
            echo "<script>alert('Wrong email or  password please try again.');</script>";
        } else {
            if ($row['role'] == 'Admin') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'admin/admin_dashboard.php'; </script>";
            }
            elseif ($row['role'] == 'Staff') {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'staff/index.php'; </script>";
            }
            else {
                $_SESSION['alogin']=$row['emp_id'];
                $_SESSION['arole']=$row['Department'];
                echo "<script type='text/javascript'> document.location = 'heads/index.php'; </script>";
            }
        }
    } 
    else{
        echo "<script>alert('Wrong email or password please try again.');</script>";
    }

}
// $_SESSION['alogin']=$_POST['username'];
//  echo "<script type='text/javascript'> document.location = 'changepassword.php'; </script>";
?>