-1

I have an issue.i need to connect my database and fetch the table value.But it is not happening like that.I am explaining my code below.

index.php:

<?php
session_start();
include_once 'dbcon/DBConnection.php';
$dbobj = new DBConnection();
$dbobj->connect();  
if (isset($_REQUEST['msg'])){
    $msg = urlencode($_REQUEST['msg']);
}
if(isset($_POST["login"])){
    //echo 'hii';exit;
    $loginid=htmlspecialchars(trim($_POST['txtname']));
    $password =sha1(htmlspecialchars(trim($_POST['pwd'])));
    //echo $password;exit;
    $admin = $dbobj->adminLogin($loginid,$password);
    //echo ($admin->result);exit;
    if($admin->result == 2){
        $msg ='2';
    }
    if($admin->result ==1){
        $_SESSION["admin_id"] = $admin->adminid;
        $_SESSION["admin_name"] = $admin->adminname;
        $_SESSION["admin_loginid"] = $admin->adminloginid;
        header("location:dashboard.php");
    }
}
?>
<script>
function valid()
{
    var obj = document.frmlogin;
    if(obj.txtname.value == "")
    {
        alert("Please Enter Username");
        obj.txtname.focus();
        return false;
    }
    if(obj.pwd.value == "")
    {
        alert("Please Enter Password");
        obj.pwd.focus();
        return false;   
    }
    else
    {
        return true;
    }
}
</script>
<form method="post" name="frmlogin" id="frmlogin" action="" autocomplete="off" class="mt">
<label for="" class="text-uppercase text-sm">Username</label>
<input type="text" placeholder="Username" name="txtname" class="form-control mb">
<label for="" class="text-uppercase text-sm">Password</label>
<input type="password" placeholder="Password" name="pwd" class="form-control mb">
<div class="checkbox checkbox-circle checkbox-info">
<input id="checkbox7" type="checkbox" checked>
<label for="checkbox7">
    Keep me signed in
</label>
</div>

<button class="btn btn-primary btn-block" name="login" id="login" type="submit" onClick="return valid();">LOGIN</button>

</form>

DBConnection.php:

<?php

class DBConnection{
    function __construct() {

    }
    // destructor
    function __destruct() {
        // $this->close();
    }
    public function connect() {
        require_once 'dbcon/config.php';
        $con = new mysqli(DB_HOST, DB_USER, DB_PASSWORD, DB_DATABASE);      
        if ($con->connect_error)die("Connection failed: "); 
        // return database handler
        return $con;
    }
    public function adminLogin($loginid,$password){
        $admin = new AdminUser();
        if(ctype_alnum($loginid)){
            $sqllogin=sprintf("select * from ".PREFIX."admin where username='%s' and trim(password)='%s' and status=1",mysqli_real_escape_string($con,$loginid),mysqli_real_escape_string($con,$password));

            $dbsql=mysqli_query($con,$sqllogin);

            $Num = mysqli_num_rows($dbsql);
            echo $Num;exit;
            if($Num >0){
                if($row=mysqli_fetch_array($dbsql)){
                    $admin->adminid =htmlspecialchars($row['id']);  
                    $admin->adminname =htmlspecialchars($row['name']);
                    $admin->adminloginid =htmlspecialchars($row['username']);
                    $admin->result=1; 
                }
            }else{
                $admin->result=2;
            }
        }else{
            $admin->result=2;
        }
        return $admin;
    }
}
?>

Here i am trying to echo the number of rows present but its displaying nothing.Please help me to resolve this issue.

satya
  • 3,282
  • 6
  • 37
  • 104
  • 3
    You are using mysql_real_escape_string but you are connecting with mysqli so use mysqli_real_escape_string – Mihai May 02 '16 at 11:57
  • in config.php file i have declared the credentials and its correct. – satya May 02 '16 at 12:00
  • Your $con is visible in connect function so your other function cant see it ,AFAIK. – Mihai May 02 '16 at 12:05
  • @Mihai : Can youmake this correct ? – satya May 02 '16 at 12:07
  • put `ini_set('display_errors', true); error_reporting(E_ALL);` in the head of your code, it will display all errors and notices and warnings, easier to debug a script with this. – Bobot May 02 '16 at 12:19
  • **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure that you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard May 02 '16 at 16:02

1 Answers1

0

As a base of reflection, if you use OOP, use it as OOP and not as function libs.

I started something for you, you just have to use it like this :

$db = new DBConnection('host', 'user', 'pass', 'database_name');

$db->connect();

$data = $db->adminLogin('login', 'password');

-

class DBConnection
{
    protected $_host = null;
    protected $_user = null;
    protected $_pass = null;
    protected $_database = null;

    protected $_con = null;

    public function __construct($host, $user, $pass, $db)
    {
        $this->_host = $host;
        $this->_user = $user;
        $this->_pass = $pass;
        $this->_database = $db;
    }

    function __destruct()
    {
        //$this->close();
    }

    public function connect()
    {
        $con = new mysqli($this->_host, $this->_user, $this->_pass, $this->_database);

        if ($con->connect_error)
        {
            die("Connection failed: ");
        }

        $this->_con = $con;

        return $con;
    }
    public function adminLogin($login, $password)
    {
        $admin = new AdminUser();

        if( ctype_alnum($login) )
        {
            $sqllogin = sprintf(
                "select * from ".PREFIX."admin where username='%s' and trim(password)='%s' and status=1",
                mysqli_real_escape_string($this->_con, $login),
                mysqli_real_escape_string($this->_con, $password));

            $dbsql=mysqli_query($this->_con,$sqllogin);

            $Num = mysqli_num_rows($dbsql);
            echo $Num;exit;
            if($Num >0){
                if($row=mysqli_fetch_array($dbsql)){
                    $admin->adminid =htmlspecialchars($row['id']);
                    $admin->adminname =htmlspecialchars($row['name']);
                    $admin->adminloginid =htmlspecialchars($row['username']);
                    $admin->result=1;
                }
            }else{
                $admin->result=2;
            }
        }else{
            $admin->result=2;
        }
        return $admin;
    }
}

Btw please see about prepare & bindParam & execute & get_result

Bobot
  • 1,118
  • 8
  • 18
  • @JayBlanchard take a look at his Q, just gave him a start, your comment should be on HIS post. Btw I'm fully agree with what you are saying here. You can post an EDIT request or simply a new answer :) – Bobot May 02 '16 at 14:32