# My ID and password won't login

**URL:** <https://www.phphelp.com/t/my-id-and-password-wont-login/22326>\
**Category:** Security and PHP\
**Created:** [March 15, 2014, 1:47pm UTC](https://www.phphelp.com/t/my-id-and-password-wont-login/22326 "2014-03-15T13:47:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ManInTheMiddle](https://www.phphelp.com/letter_avatar_proxy/v4/letter/m/d07c76/32.png) [@ManInTheMiddle](https://www.phphelp.com/u/ManInTheMiddle)\
**Post date:** [March 15, 2014, 1:47pm UTC](https://www.phphelp.com/t/my-id-and-password-wont-login/22326/1 "2014-03-15T13:47:12Z")

</div>

Hi.

I’m implementing a student number and password login system for a project management system using PHP and SQL.

I have the encryption (sha1) working in a registration fine but when I try login with the ID and password it won’t login even though the creds are correct…

here’s the code

```auto
if (isset($_POST['submit'])) { // Form has been submitted.
		$errors = array();

		// perform validations on the form data
		$required_fields = array('id', 'password');
		$errors = array_merge($errors, check_required_fields($required_fields, $_POST));

		$fields_with_lengths = array('id' => 20, 'password' => 50);
		$errors = array_merge($errors, check_max_field_lengths($fields_with_lengths, $_POST));

		$stu_num = trim(mysql_prep($_POST['id']));
		$password = trim(mysql_prep($_POST['password']));
		$hashed_password = sha1($password);
		
		if ( empty($errors) ) {
			// Check database to see if ID and the hashed password exist there.
			$query = "SELECT *";
			$query .= "FROM users ";
			$query .= "WHERE id = '{$stu_num}' ";
			$query .= "AND hashed_password = '{$hashed_password}' ";
			$query .= "LIMIT 1";
			$result_set = mysql_query($query);
			confirm_query($result_set);
			if (mysql_num_rows($result_set) == 1) {
				// ID/password authenticated
				// and only 1 match
				$found_user = mysql_fetch_array($result_set);
				redirect_to("student_content.php");
			} else {
				// ID/password combo was not found in the database
				$message = "ID/password combination incorrect.<br />
					Please make sure your caps lock key is off and try again.";
			}
		} else {
			if (count($errors) == 1) {
				$message = "There was 1 error in the form.";
			} else {
				$message = "There were " . count($errors) . " errors in the form.";
			}
		}

```

The ID and password are stored in a users table in a DB.

Any help is greatly appreciated.

---

<div class="post-metadata">

**Author:** ![JimL](https://www.phphelp.com/user_avatar/www.phphelp.com/jiml/32/1842_2.png) [@JimL](https://www.phphelp.com/u/JimL)\
**Post date:** [March 15, 2014, 3:34pm UTC](https://www.phphelp.com/t/my-id-and-password-wont-login/22326/2 "2014-03-15T15:34:50Z")

</div>

SHA1 isn’t encryption, it’s a hash routine. It also is too fast to be recommended for use in login systems. Please consider changing to to Bcrypt or pbkdf2.

[hr]

The mysql\_\* functions are deprecated and will be removed from PHP in a later version. You should use Mysqli or PDO instead.

[hr]

In Mysqli or PDO you no longer need to “prep” or escape variables that you’re using in sql queries. You are instead doing something called parameterized queries. I have a PDO tutorial here which gives a quick introduction for this stuff.

Basically this means that instead of

```auto
"SELECT * FROM users WHERE id = " . mysql_real_escape_string($userId)
```

You do

```auto
"SELECT * FROM users WHERE id = ?"
```

[hr]

This looks like a mess:  
[php]$query = “SELECT \*”;  
$query .= "FROM users ";  
$query .= "WHERE id = ‘{$stu\_num}’ ";  
$query .= "AND hashed\_password = ‘{$hashed\_password}’ ";  
$query .= “LIMIT 1”;[/php]

You could write it like this instead:  
[php]$query = “SELECT \* FROM users  
WHERE id = ?  
AND hashed\_password = ?  
LIMIT 1”;[/php]

[hr]

For the task at hand, check if $hashed\_password in line 13 is the same hash as you have stored in your database.

---

<div class="post-metadata">

**Author:** ![ManInTheMiddle](https://www.phphelp.com/letter_avatar_proxy/v4/letter/m/d07c76/32.png) [@ManInTheMiddle](https://www.phphelp.com/u/ManInTheMiddle)\
**Post date:** [March 17, 2014, 4:28pm UTC](https://www.phphelp.com/t/my-id-and-password-wont-login/22326/3 "2014-03-17T16:28:13Z")

</div>

Got it sorted man. I was using a different type of encryption in the registration than the login. Use sha1 in both and it works perfect…