title: PHP Login connecting to MySQL database with SHA1
body: <p>I'm having trouble with a simple login form and accessing the database. For the exercise, I have to create a simple login form, access the database with SHA1 encryption, then access a members area, but whenever I try to login, I get an invalid username/password message.</p>
  
  <p>Am I storing the hashed password correctly? How do I then access it from the database? I've tried numerous times.</p>
  
  <p>I know it's not good practice to hash passwords with SHA1, but this is part of the exercise I've been set, and I can't see where I'm going wrong.</p>
  
  <p><strong>dbconnect.php</strong></p>
  
  <pre><code>&lt;?php
  
     $DBhost = "localhost";
     $DBuser = "root";
     $DBpass = "";
     $DBname = "";
  
     $DBcon = mysqli_connect($DBhost,$DBuser,$DBpass,$DBname);
  
     if ($DBcon-&gt;connect_errno) {
         die("ERROR : -&gt; ".$DBcon-&gt;connect_error);
     }
  </code></pre>
  
  <p><strong>index.php</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  require_once 'dbconnect.php';
  
  if (isset($_SESSION['userSession'])!="") {
      header("Location: home.php");
      exit;
  }
  
  if (isset($_POST['btn-login'])) {
  
      $userName = strip_tags($_POST['userName']);
      $password = strip_tags($_POST['password']);
  
      $userName = $DBcon-&gt;real_escape_string($userName);
      $password = $DBcon-&gt;real_escape_string($password);
  
      $query = $DBcon-&gt;query("SELECT userID, userName, password 
      FROM user WHERE userName='$userName'");
      $row=$query-&gt;fetch_array();
  
      $count = $query-&gt;num_rows; 
  
      if (password_verify($password, $row['password']) 
      &amp;&amp; $count==1) {
          $_SESSION['userSession'] = $row['userID'];
      header("Location: home.php");
      } else {
      $msg = "&lt;div class='alert alert-danger'&gt;
       Invalid Username or Password !&lt;/div&gt;";
      }
      $DBcon-&gt;close();
  }
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;body&gt;
  
  &lt;div class="signin-form"&gt;
  
      &lt;div class="container"&gt;
  
  
         &lt;form class="form-signin" method="post" id="login-form"&gt;
  
          &lt;h2 class="form-signin-heading"&gt;Sign In.&lt;/h2&gt;
  
          &lt;?php
          if(isset($msg)){
              echo $msg;
          }
          ?&gt;
  
          &lt;div class="form-group"&gt;
          &lt;input type="userName" class="form-control" 
          placeholder="Username" name="userName" required /&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
          &lt;input type="password" class="form-control" 
          placeholder="Password" name="password" required /&gt;
      &lt;/div&gt;
  
  
          &lt;div class="form-group"&gt;
              &lt;button type="submit" class="btn btn-default" 
           name="btn-login" id="btn-login"&gt; Sign In &lt;/button&gt; 
  
              &lt;a href="register.php" class="btn btn-default" 
          style="float:right;"&gt;Sign UP Here&lt;/a&gt;
  
          &lt;/div&gt;  
  
  
        &lt;/form&gt;
  
      &lt;/div&gt;
  
  &lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>register.php</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  if (isset($_SESSION['userSession'])!="") {
      header("Location: home.php");
  }
  require_once 'dbconnect.php';
  
  if(isset($_POST['btn-signup'])) {
  
      $userName = strip_tags($_POST['userName']);
      $email = strip_tags($_POST['email']);
      $upass = strip_tags($_POST['password']);
  
      $userName = $DBcon-&gt;real_escape_string($userName);
      $email = $DBcon-&gt;real_escape_string($email);
      $upass = $DBcon-&gt;real_escape_string($upass);
  
      $hashed_password = sha1($upass); 
  
      $check_email = $DBcon-&gt;query("SELECT email FROM user 
      WHERE email='$email'");
      $count=$check_email-&gt;num_rows;
  
      if ($count==0) {
  
          $query = "INSERT INTO user(userName,email,password) 
          VALUES('$userName','$email','$hashed_password')";
  
          if ($DBcon-&gt;query($query)) {
              $msg = "&lt;div class='alert alert-success'&gt;
                           successfully registered !
                      &lt;/div&gt;";
          }else {
              $msg = "&lt;div class='alert alert-danger'&gt;
                           error while registering !
                      &lt;/div&gt;";
          }
  
      } else {
  
  
          $msg = "&lt;div class='alert alert-danger'&gt;
                       sorry email already taken !
                  &lt;/div&gt;";
  
      }
  
      $DBcon-&gt;close();
  }
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
  
  &lt;title&gt;Login &amp; Registration System&lt;/title&gt;
  
  &lt;/head&gt;
  &lt;body&gt;
  
  &lt;div class="signin-form"&gt;
  
      &lt;div class="container"&gt;
  
  
         &lt;form class="form-signin" method="post" id="register-form"&gt;
  
          &lt;h2 class="form-signin-heading"&gt;Sign Up&lt;/h2&gt;&lt;hr /&gt;
  
          &lt;?php
          if (isset($msg)) {
              echo $msg;
          }
          ?&gt;
  
          &lt;div class="form-group"&gt;
          &lt;input type="text" class="form-control" 
           placeholder="Username" name="userName" required /&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
          &lt;input type="email" class="form-control" 
          placeholder="Email address" name="email" required /&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
          &lt;input type="password" class="form-control" 
          placeholder="Password" name="password" required /&gt;
          &lt;/div&gt;
  
  
  
          &lt;div class="form-group"&gt;
              &lt;button type="submit" class="btn btn-default" 
              name="btn-signup"&gt;Create Account&lt;/button&gt; 
              &lt;a href="index.php" class="btn btn-default" 
              style="float:right;"&gt;Log In Here&lt;/a&gt;
         &lt;/div&gt; 
  
        &lt;/form&gt;
  
      &lt;/div&gt;
  
  &lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>home.php</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  include_once 'dbconnect.php';
  
  if (!isset($_SESSION['userSession'])) {
      header("Location: index.php");
  }
  
  $query = $DBcon-&gt;query("SELECT * FROM user WHERE
  userID=".$_SESSION['userSession']);
  $userRow=$query-&gt;fetch_array();
  $DBcon-&gt;close();
  
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  </code></pre>
  
  <p><strong>logout.php</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  
  if (!isset($_SESSION['userSession'])) {
       header("Location: index.php");
  } else if (isset($_SESSION['userSession'])!="") {
      header("Location: home.php");
  }
  
  if (isset($_GET['logout'])) {
      session_destroy();
      unset($_SESSION['userSession']);
      header("Location: index.php");
  }
  ?&gt;
  </code></pre>