diff --git a/login.php b/login.php index 1b8c9c9..2d4b347 100644 --- a/login.php +++ b/login.php @@ -3,18 +3,23 @@ session_start(); $conn = new mysqli("localhost","root","","breakout_db"); if($conn->connect_error){ die("DB Error"); } -// Register if(isset($_POST['register'])){ $u = $_POST['user']; $p = password_hash($_POST['pass'], PASSWORD_DEFAULT); - $conn->query("INSERT INTO users(username,password,highscore) VALUES('$u','$p',0)"); + $u_safe = $conn->real_escape_string($u); + $conn->query("INSERT INTO users(username,password,highscore) VALUES('$u_safe','$p',0)"); + if($conn->affected_rows > 0) { + $_SESSION['user'] = $u; + header("Location: index.php"); + exit; + } } -// Login if(isset($_POST['login'])){ $u = $_POST['user']; $p = $_POST['pass']; - $res = $conn->query("SELECT * FROM users WHERE username='$u'"); + $u_safe = $conn->real_escape_string($u); + $res = $conn->query("SELECT * FROM users WHERE username='$u_safe'"); if($row = $res->fetch_assoc()){ if(password_verify($p, $row['password'])){ $_SESSION['user'] = $u; @@ -29,48 +34,14 @@ if(isset($_POST['login'])){