Question

I am trying to create a login with username or email

My code is:

$username=$_REQUEST['login'];
$email=$_REQUEST['login'];
$password=$_REQUEST['password'];

if($username && $password) {
  $query="select * from  user_db where username='$username'";
} else if ($email && $password) {
  $query="select * from  user_db where email='$email'";
}

Login with username is success but login with email is not working.

Answer 1

The login parameter is the same for both email and username. Not exactly incorrect if you have a single login box that accepts either.

You could put the condition in the query itself if you’re not sure if it’s an email or username.

$login=$_REQUEST['login'];
$query = "SELECT * FROM user_db WHERE username='$login' OR email = '$login'"

A PDO-like solution is much more preferred nowadays as the above is subject to SQL injection. The logic stays the same, but you’d have it look something like this:

$query = "
    SELECT * FROM user_db
       WHERE username = :username OR email = :username
";

$statement = $pdoObject->prepare($query);
$statement->bindValue(":username", $login, PDO::PARAM_STR);
$statement->execute();