Member Avatar for NA

hi everyone hope you all are in good.
i have query while login form in php with oracle database..... i want to simple login with database
html code:

<p> <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
Username:<br /><input type="text" name="username" size="10" /><br />
Password:<br /><input type="password" name="password" size="10" /><br /> <input type="submit" value="Login" /> </form> </p>

php code:

<?php
session_start();
 if (! isset($_SESSION['username'])) {
 if (isset($_POST['username']))
{
$username = htmlentities($_POST['username']);
$password = htmlentities($_POST['password']);
$conn = oci_connect('user', 'pswrd', 'db')
or die("Can't connect to database server!");

$query = "SELECT username, password FROM users
WHERE username=:username AND password=:password";
   $stmt = oci_parse($conn, $query);
   oci_bind_by_name($stmt, ':username', $username, 8);
oci_bind_by_name($stmt, ':password', $password, 32);
oci_execute($stmt);
list($username, $password) = oci_fetch_array($stmt, OCI_NUM);
if ($username != "")
{
$_SESSION['username'] = $username;
echo "You've successfully logged in. ";
}
   } else {
include "login.html";
}
} else {
printf("Welcome back, %s!", $_SESSION['username']);
}
?>
  • 2 Contributors
  • 1 Reply
  • 540 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

As pointed out, the biggest problem is storing and comparing plaintext passwords. Beyond that, the original code has a few other practical issues to fix before it’s safe and reliable: using htmlentities() on raw input (that’s for output), passing a small $maxlength to oci_bind_by_name() (that can silently truncate input), and not regenerating the session ID after login. Below is a concise, safer pattern to follow.

/* example: look up hash and verify */
$user = trim($_POST['username']);
$pw   = $_POST['password'];

$stid = oci_parse($conn, 'SELECT password_hash FROM users WHERE username = :u');
oci_bind_by_name($stid, ':u', $user);            // avoid small maxlength here
oci_execute($stid);
$row = oci_fetch_array($stid, OCI_ASSOC+OCI_RETURN_NULLS);

if ($row && password_verify($pw, $row['PASSWORD_HASH'])) {
    session_regenerate_id(true);
    $_SESSION['username'] = $user;
    // logged in
} else {
    // authentication failed
}

Notes and practical tips:

  • Use password_hash() when creating accounts and store the hash (VARCHAR2(255) is safe for Oracle). Use password_needs_rehash() on upgrade paths.
  • Don’t htmlentities() before database checks; apply htmlspecialchars() only when echoing to HTML.
  • The fourth arg to oci_bind_by_name() is a maximum length — setting it too small (e.g., 8) truncates input. Omit it unless you need it and set a sensible size when used.
  • Oracle returns column names in uppercase by default, so associative keys like PASSWORD_HASH are uppercase.
  • Always use HTTPS, set secure/httponly session cookie flags, call session_regenerate_id(true) after login, and throttle/lock after repeated failures.
  • For debugging, use oci_error() (log errors server-side) and don’t expose DB errors to users.

These changes keep authentication simple but far more secure and robust than plaintext comparison.

Member Avatar for rproffitt

I see on line 15 a basic flaw. You are storing passwords which is a big no no.
Read why at https://www.google.com/search?q=Never+store+passwords+in+a+database

What should you do? Store a hashed, salted version and compare that to the user's hashed, salted result. There are so many priors in PHP that I get the feeling you are not researching.

Research this area and never ever implement what you have above. It's just not done.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.