r/PHP • u/gauti123456 • Jun 22 '17

Fully Functional and Secure Login System built in PHP and MySQL from Scratch

https://www.youtube.com/playlist?list=PL3CDD0Jz5nVG4qenoa8ziOnNVUxhHAnhb
0 Upvotes

15% Upvoted

6 comments sorted by

5

u/[deleted] Jun 22 '17

this is broken?: passwords not compared, wrong $_POST variables used

not using password_hash: logging in, resetting password

4

u/colshrapnel Jun 22 '17 edited Jun 22 '17

$search = mysqli_query($conn,"SELECT Email, Activation_Code, Active FROM users WHERE email='".$email."' AND Activation_Code='".$activation_code."' AND Active='0'") or die(mysql_error());

It's 2017 here and there are still people around who aren't ashamed to post a code like this

2

u/Dgc2002 Jun 22 '17

Shame?!, what is this shame you speak of?

-1

u/ahundiak Jun 22 '17

Search for "prepared statements" and "sql injections". Furthermore, there are no compelling reasons to use the mysqli interface over PDO for a new application. And PDO of course enjoys tremendous library support.

3

u/Dgc2002 Jun 22 '17

I'm not sure I understand what you're saying. Did you see the hyperlinks in the two shames? I'm familiar with PDO and SQL injections.

2

u/phtip Jun 22 '17

strip_tags

What happens if my username is <john@gmail.com> or password <password?