PHP Login with PDO

Question

Hello i try to make login but it's not working with me i have wrong in syntax the code is below, Please help me

Database Tabel

CREATE TABLE IF NOT EXISTS `users` (
`id` bigint(20) NOT NULL AUTO_INCREMENT,
`user_name` varchar(150) NOT NULL DEFAULT '',           
`password` varchar(255) NOT NULL DEFAULT '',
`email` varchar(225) NOT NULL,
`mobile` varchar(225) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci AUTO_INCREMENT=2 ;

--
-- Dumping data for table `users`
--

INSERT INTO `users` (`id`, `user_name`, `password`, `email`, `mobile`) VALUES
(1, 'eddy', '32316a4f55bb533b0c12855c2e48b211', 'eddy@example.com', '12345');

The MD5 Password for user eddy is: global123

login.php

<?php
 // Start the session
 session_start();

 // Database information
 $servername = "localhost";
 $username = "root";
 $password = "";
 $dbname = "users";

 try {
$conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);
// set the PDO error mode to exception
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
echo "Connected successfully"; 
}
 catch(PDOException $e)
{
echo "Connection failed: " . $e->getMessage();
}



 // Check input 
 function checker_input($data) {
   $data = trim($data);
   $data = stripslashes($data);
   $data = htmlspecialchars($data);
   return $data;
 }

 // Login Checker

 // define variables and set to empty values
 $usernameErr = $passwordErr = "";
 $username = $password = "";



 if(!empty($_SESSION['LoggedIn']) && !empty($_SESSION['Username']))
 {
// let the user access the main page
header("Location: home.php");
 }


 else(!empty($_POST['username']) && !empty($_POST['password']))
 {


// let the user login

if (empty($_POST["username"])) {
$usernameErr = "Username is required";
   } else {
$username = test_input($_POST["username"]);
   }

     if (empty($_POST["password"])) {
     $passwordErr = "Password is required";
   } else {
     $password = md5 checker_input($_POST["password"]);
   } 


$stmt = $conn->prepare("SELECT * FROM users WHERE user_name:username AND password:password"); 
$stmt->execute();
$userRow=$stmt->fetch(PDO::FETCH_ASSOC);

if($stmt->rowCount() == 1)
{
    $email = $userRow['email'];

    $_SESSION['user_name'] = $username;
    $_SESSION['email'] = $email;
    $_SESSION['mobile'] = $mobile;
    $_SESSION['LoggedIn'] = 1;

    echo "<h1>Success</h1>";

    }
else
{
    echo "<h1>Error</h1>";
    echo "<p>Sorry, your account could not be found.</p>";
}


 }
 ?>

    <form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>">
    <label>Username:</label><input type="text" name="username"/><?php echo $usernameErr;?><br/>
    <label>Password:</label><input type="password" name="password"/><?php echo $passwordErr;?><br/>
    <input type="submit" name="login" id="login" value="Login" />
    </form>

And also how can i make home page show user his username and email and password home.php

<p>Thanks for logging in!<br>
      You are <?=$_SESSION['username']?> and your email address is <?=$_SESSION['email']?> and mobile <?=$_SESSION['mobile']?>.</p>

Answer 1

your very first else has brackets replace that with else { (line 47)

than use this if around line (line 66 - 86) like so because there no need to query the database if the fields are empty place this at line 65 and close it with an } at line 87:

if(!empty($_POST['username']) && !empty($_POST['password'])) { 

md5 should have brackets around checker_input function call (line 62) like so:

$password = md5(checker_input($_POST["password"]));

test input function doesn't exist i assume you wanted to use check_input_function here so replace it with that (line 56)

query at (line 66) was not correctly should be:

'SELECT * FROM users WHERE user_name = :username AND password = :password'

variables need to be binded like this (place this under your statement below line 66):

  $stmt->bindParam(':username', $username, PDO::PARAM_STR);
  $stmt->bindParam(':password', $password, PDO::PARAM_STR);

And than once you are logged in $mobile variable is not filled in yet not sure what you want in there (line 76)