title: PHP MYSQLI prepared statements login and check the user status
body: <p>I am learning to make website with some video tutorials based on mysqli. I came to know that using prepared statements are more secure and I am trying to create a login system. Here is what I have done so far.</p>
  <p>This code helps me login success fully.</p>
  <pre><code>&lt;form action =&quot;&quot; method=&quot;post&quot;&gt;
  
  User Name:&lt;br/&gt;
  &lt;input type='text' name='username' /&gt;
  &lt;br/&gt;&lt;br/&gt;
  Password:&lt;br/&gt;
  &lt;input type='password' name='password' /&gt;
  &lt;br/&gt;&lt;br/&gt;
  &lt;input type='submit' name='submit' value='login'&gt;
  &lt;/form&gt;
  &lt;?php
  
  if(isset($_POST['submit'])){
      $username = $_POST['username'];
      $password = md5($_POST['password']);
      $stmt = $con-&gt;prepare(&quot;SELECT username, password FROM users WHERE username=? AND  password=? LIMIT 1&quot;);
      $stmt-&gt;bind_param('ss', $username, $password);
      $stmt-&gt;execute();
      $stmt-&gt;bind_result($username, $password);
      $stmt-&gt;store_result();
      if($stmt-&gt;num_rows == 1)  //To check if the row exists
          {
              while($stmt-&gt;fetch()) //fetching the contents of the row
  
                {$_SESSION['Logged'] = 1;
                 $_SESSION['username'] = $username;
                 echo 'Success!';
                 exit();
                 }
          }
          else {
              echo &quot;INVALID USERNAME/PASSWORD Combination!&quot;;
          }
          $stmt-&gt;close();
      }
      else 
      {   
  
      }
      $con-&gt;close();
  ?&gt;
  </code></pre>
  <p>But I also need to check if the user have not activated or have been banned or deactivated. So I made another code.</p>
  <p>And here is the code I made</p>
  <pre><code>&lt;?php
  if(isset($_POST['submit'])){
  $username = $_POST['username'];
  $password = md5($_POST['password']);
  $stmt = $con-&gt;prepare(&quot;SELECT username, password FROM users WHERE username=? AND    password=? LIMIT 1&quot;);
  $stmt-&gt;bind_param('ss', $username, $password);
  $stmt-&gt;execute();
  $stmt-&gt;bind_result($username, $password);
  $stmt-&gt;store_result();
  if($stmt-&gt;num_rows == 1)  //To check if the row exists
    {
   $result=$con-&gt;query($stmt);
              $row=$result-&gt;fetch_array(MYSQLI_ASSOC);
              $user_id= $row['user_id'];
              $status = $row['status'];
              if($status=='d'){
                  echo &quot;YOUR account has been DEACTIVATED.&quot;;
              }else{
                  $_SESSION['Logged'] = 1;
                  $_SESSION['user_id'] = $user_id;
                  $_SESSION['username'] = $username;
                  echo 'Success!';
                 exit();
              }
          }
          else {
              echo &quot;INVALID USERNAME/PASSWORD Combination!&quot;;
          }
          $stmt-&gt;free_result();
          $stmt-&gt;close();
          
      }
      else 
      {   
  
      }
   $con-&gt;close();
   ?&gt;
  </code></pre>
  <p>When I use this I get the following errors</p>
  <blockquote>
  <p>Warning: mysqli::query() expects parameter 1 to be string, object given in F:\XAMPP\htdocs\login\login.php on line 33</p>
  <p>Fatal error: Call to a member function fetch_array() on a non-object in F:\XAMPP\htdocs\login\login.php on line 34</p>
  </blockquote>
  <p>I have database table columns</p>
  <p>user_id,
  username,
  password (md5),
  user_level,
  status.</p>
  <p>Under user_level I have the following</p>
  <pre><code>a = admin
  m = member
  </code></pre>
  <p>Under status</p>
  <pre><code>a = activated
  n = not activated
  d = deactivated
  b = banned
  </code></pre>
  <p>While logging in I need to check if the user status and if it is activated it should move to index page or if it is d it should show the user has been deactivated and likewise for others.</p>
  <p>How to do it in prepared statements?</p>
  <p>And I have this connect.php in all page</p>
  <pre><code>?php
  //error_reporting(0);
  'session_start';
  $con = new mysqli('localhost', 'username', 'password', 'database');
  if($con-&gt;connect_errno &gt; 0){
  die('Sorry, We\'re experiencing some connection problems.');
  }
  ?&gt;
  </code></pre>