title: What do i insert after "SELECT id, username, password FROM users WHERE username = ?"
body: <p>So i have a full code from an online tutorial and unfortunately when they provide the code there are certain areas which i have no idea what to put in. I know this could be very basic, but to people who don't know much about sql and php codes, they too will have some difficulty figuring out the basics. </p>
  
  <p>Alot of people put the hard questions but never the simple basic questions that starters like me struggle to understand. </p>
  
  <p><em>Here is the <a href="https://www.tutorialrepublic.com/php-tutorial/php-mysql-login-system.php" rel="nofollow noreferrer">a link</a>! where i got the information from.</em></p>
  
  <p>I've tried going on <strong>google</strong> and going through <strong>stackoverflow</strong>, and <strong>webdevtrick</strong> but all the questions or concerns the people have are harder solving problems than the basic one i have.</p>
  
  <h1>Validate credentials</h1>
  
  <pre><code>        // Prepare a select statement
          $sql = "SELECT id, username, password FROM users WHERE username = ?";
  </code></pre>
  
  <p>So i've tried to put a <em>1</em>, <em>0</em>, and i've tried putting <em>'username'</em> in the <strong>question mark area</strong> but no luck. All it backfires me with is <em>Oops! Something went wrong. Please try again later.</em></p>
  
  <p><strong>CODE AFTER THE VALIDATE CREDENTIALS</strong></p>
  
  <pre><code>            // Bind variables to the prepared statement as parameters
              mysqli_stmt_bind_param($stmt, "s", $param_username);
  
              // Set parameters
              $param_username = $username;
  
              // Attempt to execute the prepared statement
              if(mysqli_stmt_execute($stmt)){
                  // Store result
                  mysqli_stmt_store_result($stmt);
  
                  // Check if username exists, if yes then verify password
                  if(mysqli_stmt_num_rows($stmt) == 1){                    
                      // Bind result variables
                      mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password);
                      if(mysqli_stmt_fetch($stmt)){
                          if(password_verify($password, $hashed_password)){
                              // Password is correct, so start a new session
                              session_start();
  
                              // Store data in session variables
                              $_SESSION["loggedin"] = true;
                              $_SESSION["id"] = $id;
                              $_SESSION["username"] = $username;                            
  
                              // Redirect user to welcome page
                              header("location: welcome.php");
                          } else{
                              // Display an error message if password is not valid
                              $password_err = "The password you entered was not valid.";
                          }
                      }
                  } else{
                      // Display an error message if username doesn't exist
                      $username_err = "No account found with that username.";
                  }
              } else{
                  echo "Oops! Something went wrong. Please try again later.";
              }
          }
  
          // Close statement
          mysqli_stmt_close($stmt);
      }
  
      // Close connection
      mysqli_close($link);
  }
  </code></pre>
  
  <p>I bet it's so basic, but i'm hoping that if someone else who is also having difficulty with this will help them and understand what they should put in that statement. Thank you for the help, and if you need more information please let me know. </p>
  
  <p>THANK YOU!</p>
  
  <p><strong>EDIT FOR THE PERSON WHO WANTED TO SEE THE WHOLE CODE</strong></p>
  
  <pre><code>// Initialize the session
  session_start();
  
  // Check if the user is already logged in, if yes then redirect him to welcome page
  if(isset($_SESSION["loggedin"]) &amp;&amp; $_SESSION["loggedin"] === true){
    header("location: welcome.php");
    exit;
  }
  
  // Include config file
  require_once "config.php";
  
  // Define variables and initialize with empty values
  $username = $password = "";
  $username_err = $password_err = "";
  
  // Processing form data when form is submitted
  if($_SERVER["REQUEST_METHOD"] == "POST"){
  
      // Check if username is empty
      if(empty(trim($_POST["username"]))){
          $username_err = "Please enter username.";
      } else{
          $username = trim($_POST["username"]);
      }
  
      // Check if password is empty
      if(empty(trim($_POST["password"]))){
          $password_err = "Please enter your password.";
      } else{
          $password = trim($_POST["password"]);
      }
  
      // Validate credentials
      if(empty($username_err) &amp;&amp; empty($password_err)){
          // Prepare a select statement
          $sql = "SELECT id, username, password FROM users WHERE username = ?";
  
          if($stmt = mysqli_prepare($link, $sql)){
  
              // Set parameters
              $param_username = $username;
  
              // Bind variables to the prepared statement as parameters
              mysqli_stmt_bind_param($stmt, "s", $param_username);
  
              // Attempt to execute the prepared statement
              if(mysqli_stmt_execute($stmt)){
                  // Store result
                  mysqli_stmt_store_result($stmt);
  
                  // Check if username exists, if yes then verify password
                  if(mysqli_stmt_num_rows($stmt) == 1){                    
                      // Bind result variables
                      mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password);
                      if(mysqli_stmt_fetch($stmt)){
                          if(password_verify($password, $hashed_password)){
                              // Password is correct, so start a new session
                              session_start();
  
                              // Store data in session variables
                              $_SESSION["loggedin"] = true;
                              $_SESSION["id"] = $id;
                              $_SESSION["username"] = $username;                            
  
                              // Redirect user to welcome page
                              header("location: welcome.php");
                          } else{
                              // Display an error message if password is not valid
                              $password_err = "The password you entered was not valid.";
                          }
                      }
                  } else{
                      // Display an error message if username doesn't exist
                      $username_err = "No account found with that username.";
                  }
              } else{
                  echo "Oops! Something went wrong. Please try again later.";
              }
          }
  
          // Close statement
          mysqli_stmt_close($stmt);
      }
  
      // Close connection
      mysqli_close($link);
  }
  ?&gt;```
  </code></pre>