I’m having problems with my login system

Question

<?php
include('conexao.php');

if(empty($_POST['usuario']) || empty($_POST['senha'])) {
    header('Location: index.html');
    exit();
}


$usuario = mysqli_real_escape_string($conexao, $_POST['usuario']);
$senha = mysqli_real_escape_string($conexao, $_POST['senha']);

$query = 'select usuario_id, usuario from usuario where usuario = '{$usuario}' and senha = md5('{$senha}')';

$result =  mysqli_query($conexao, $query);

$row = mysql_num_rows($result);

if($row == 1) {
    $_SESSION['usuario'] = $usuario;
    header('Location: home.html');
    exit();
} else {
    header('Location: index.html');
    exit();
}

It returns the following error:

Parse error: syntax error, Unexpected '' and password = md5('' (T_CONSTANT_ENCAPSED_STRING) in C: xampp htdocs login.php on line 13

Please help me I have no idea what it might be ...

Answer 1

I recommend using Preparestatement for security reasons and to avoid major risks of Sqlinjection, I simulated a session by taking the user’s access profile, and the user’s id, because that’s all you would need, in theory, in a session:

if (!$_POST || empty($_POST['usuario']) || empty($_POST['senha'])) {
    header('Location: index.html');
    exit();
}

$usuario = mysqli_real_escape_string($_POST['usuario']);
$senha = MD5($_POST['senha']);

$query = "SELECT id, role FROM usuario WHERE usuario = ? AND senha = ?";

 if (!($stmt = mysqli_prepare($conexao, $query) && $usuario && $senha)) {
    header('Location: index.html');
    exit();
 } else {
    $setParams = mysqli_stmt_bind_param($stmt, "ss", $usuario, $senha);
    $execute = mysqli_stmt_execute($stmt);
    $results = mysqli_stmt_get_result($stmt);
    $array_result = mysqli_fetch_assoc($results);

    //print_r($array_result);

   if (!$results) {
        header('Location: index.html');
        exit();
    }

    if (!isset($array_result['id'])) {
        header('Location: index.html');
        exit();
    }

    session_start();
    $_SESSION['usuario'] = $usuario;
    $_SESSION['id'] = $array_result['id'];
    $_SESSION['nivel_acesso'] = $array_result['role'];
    header('Location: home.html');
    exit();
}

Answer 2

Hello @Jeanextreme002, all right? I updated the $_POST assigned in the variable "password" and updated your query. Change your code to do so:

<?php
include('conexao.php');

if(empty($_POST['usuario']) || empty($_POST['senha'])) {
    header('Location: index.html');
    exit();
}


$usuario = mysqli_real_escape_string($conexao, $_POST['usuario']);
$senha = mysqli_real_escape_string($conexao, md5($_POST['senha']));

$query = "SELECT * FROM usuario WHERE usuario = '$usuario' AND senha = '$senha'";

$result =  mysqli_query($conexao, $query);

$row = mysql_num_rows($result);

if($row == 1) {
    $_SESSION['usuario'] = $usuario;
    header('Location: home.html');
    exit();
} else {
    header('Location: index.html');
    exit();
}

I hope I helped. Regards, Minds'.