Question

I’m having trouble fetching data from my table with the following.

$email = $_POST['email'];
$password = md5($_POST['password']);

$query = "SELECT * FROM users WHERE (email,password) VALUES (:email,:password)";
  $stmt = $dbh->prepare($query);
  $stmt->bindParam(':email', $email);
  $stmt->bindParam(':password', $password);
  $stmt->execute();

if(!$query){
    echo 'Whoops, something went wrong!';
} else {
    while($r = $stmt->fetch(PDO::FETCH_LAZY)){
        echo $r['surname']; 
    }
};

Can anybody see where im going wrong? By not working, nothing is output to my browser

Answer 1

You seem to be mixing up insert and select syntax.

Your select syntax should be something like:

$query = "SELECT * FROM users WHERE email=:email AND password=:password";

Apart from that you should take a look around on SO and search for secure password hashing as md5 is not secure.