any one help me with this code !!!

[Ajithguru741]

i am trying to built urer registration and user login page

the registration page works perfectly fine.(the enterted data is stored the the database with $hash password)

<?php
 
 
$showError="false";
if($_SERVER["REQUEST_METHOD"] == "POST"){
    include '_dbconnect.php';
 
    $user_email = $_POST['signupemail'];
    $pass = $_POST['signuppassword'];
    $cpass = $_POST['signuppassword'];
 
    // check wether this email exists
 
    $existSql="select * from `users` where user_email = '$user_email'";
    $result = mysqli_query($conn, $existSql);
    $numRows = mysqli_num_rows($result);
    if($numRows>0){
        $showError = "Email already in use";
    } else{
        if($pass == $cpass){
           $hash = password_hash($pass, PASSWORD_DEFAULT);
           $sql =" INSERT INTO `users` ( `user_email`, `user_pass`, `timestamp`) VALUES ('  $user_email', '  $hash', current_timestamp())";
           $result = mysqli_query($conn, $sql);
           if($result){
            $showAlert=true;
            header("Location:/wediscuss%20forum/index.php?signupsuccess=true");
            exit();
           }
        }else{
            $showError ="passwords do not match";  
 
        }
    }
    header("Location:/wediscuss%20forum/index.php?signupsuccess=false&error= $showError ");
}
 
 
 
?>

The problem arises when i try to login . the page gets redirected but the echo is not working ( like printing THIS user is loged in)

<?php
$showError = "false";
if($_SERVER["REQUEST_METHOD"] == "POST"){
  include '_dbconnect.php';
  $email = $_POST['loginEmail'];
  $pass = $_POST['loginPass'];
 
  $sql = "SELECT * FROM `users` where user_email='$email'";
  $result = mysqli_query($conn, $sql);
  $numRows = mysqli_num_rows($result);
  if($numRows==1){
    $row = mysqli_fetch_assoc($result);
    if(password_verify(  $email, $row['user_pass'])){
          session_start();
          $_SESSION['loggedin'] = true;
            $_SESSION['slno'] = $row['slno'];
            $_SESSION['useremail'] = $email;
            echo "loggedin". $email;
 
        } 
        else{
          echo "unable to login";
 
        }
    }
 
 
?>

[bakertaylor28]

 header("Location:/wediscuss%20forum/index.php?signupsuccess=false&error= $showError ");
 

This is your problem - logins are better done by storing a session var:

...
// After checking against database We set session variable to 0 when logged out and 1 when logged in
$_SESSION['login'] === foo;
 
//We then evaluate for login:
if  ($_SESSION['login'] === 1) {
//show pasword protected content 
 header("Location:/protected/content.php");
} elseif ($_SESSION['login'] === 0) {
// deny access
 header("Location:/path/to/static/errorpage.php ");
} else {
die();
}
...
 

We check the session var on every protected page or location. it is important that we use === not == or = in order to prevent code injection, any time we're anywhere around SQL.