Question

its a little difficult to explain. I’ve build the mysql function which works fine and with the depreciation of mysql I will need to change this function to use mysqli rather than the mysql method.
I current have:

$con = mysql_connect("host", "username", "pass");
mysql_select_db("db", $con);
$Username = mysql_real_escape_string($_POST['user']);
$Password = hash_hmac('sha512', $_POST['pass'], '&R4nD0m^');
$Query = mysql_query("SELECT COUNT(*) FROM users WHERE username = '{$Username}' AND password = '{$Password}'") or die(mysql_error());
    $Query_Res = mysql_fetch_array($Query, MYSQL_NUM);
    if($Query_Res[0] === '1')
    {
        //add session
        header('Location: newpage.php');
    }
            else {
                echo 'failed login';
            }

Now I’ve applied mysqli to this and it’s not returning any data or errors but the function still complies.

$log = new mysqli("host", "user", "pass");
$log->select_db("db");
$Username = $log->real_escape_string($_POST['user']);
$Password = hash_hmac('sha512', $_POST['pass'], '&R4nD0m^');
$qu = $log->query("SELECT COUNT(*) FROM users WHERE username = '{$Username}' AND password = '{$Password}'");
    $res = $qu->fetch_array();
    if($res[0] === '1'){
        //add session
        header('Location: newpage.php');
    }
    else {
        $Error = 'Failed login';
        sleep(0.5);
    }
    echo $res['username'].'              hello';
}

But I’m unsure on why this is wrong. I know it’s probably a simply answer

Answer 1

Just to have it as an answer:

http://php.net/manual/en/pdo.prepared-statements.php
http://php.net/manual/en/pdo.prepare.php

e.g.

$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);