MySql & php not communicating properly

Unity Engine
1

hi, so i am using a sql server database for users in my game, mainly for logging in and saving data. i am using a php file to communicate between the sql server and unity.
i have a php file for inserting a user in the database (username, password, email) and i have anouther php file thats is used to log in. It is supposed to check if the username and password match then continue, the problem i am having is that it checks if the user exists just fine but basically you can type anything for a password and it lets you log in, ass posed to the correct password that is in the database

any insight to this problem would be greatly appreciated

this is my script for unity

using System.Collections;
using System.Collections.Generic;
using UnityEngine;
using UnityEngine.UI;

public class Login : MonoBehaviour
{
    //public InputField _userInputUserName;
    //public InputField _userInputPassword;

    public string inputUserName;
    public string inputPassword;

    string LoginURL = "http://localhost/MeowMeowMeow/Login.php";

    // Use this for initialization
    void Start ()
    {
      
    }


  
    // Update is called once per frame
    void Update ()
    {
        if (Input.GetKeyDown(KeyCode.L))
        {
            StartCoroutine( LoginToDB (inputUserName, inputPassword));
        }
    }

    //public void OnLogin()
    //{
        //inputUserName = _userInputUserName.text;
        //inputPassword = _userInputPassword.text;
        //StartCoroutine( LoginToDB (inputUserName, inputPassword));

    //}

    IEnumerator LoginToDB(string username, string password)
    {
        WWWForm form = new WWWForm();
        form.AddField("usernamePost", username);
        form.AddField ("passwordPost", password);

        WWW www = new WWW (LoginURL, form);

        //waits for result then returns
        yield return www;

        Debug.Log (www.text);
    }
}

and this is my php file i am using

<?php
{
    $servername = "localhost";
    $server_username = "root";
    $server_password = "";
    $dbName = "Tactics_Arena";
  
    $username = $_POST["usernamePost"];
    $password = $_POST["passwordPost"];
  
  
    //Make Connection
    $conn = new mysqli($servername, $server_username, $server_password, $dbName);
  
    //Check Connecion
    if(!$conn)
    {
        die("Connection Failed.".mysqli_connect_error());
    }
  
    $sql = "SELECT password FROM users WHERE username = '".$username."'";
    $result = mysqli_query($conn ,$sql);
  
    //get result and confirm login
    if(mysqli_num_rows($result)>0)
    {
        //show data for eatch row
        while ($row = mysqli_fetch_assoc($result))
        {
            if($row['password'] = $password)
            {
                echo "login success";
            }
            else
            {
                echo "password incorrect";
            }
        }
      
    }
    else
    {
        echo "user not found";
    }
  
}
  
?>
2

missing one extra = in

 if($row['password'] = $password)
3

can you elaborate anymore, I’m not quite understanding what you are saying
thanks

4

ohhhhh shit i feel so dumb, never mind i get it now. its always a stupid syntax thing that hangs me up for ever, thanks man/woman

5

oh, actually it seems that php string comparison should be using: ===

6

“==” did the trick

7

that can apparently cause issues, see this one,

8

huh never new, thanks for the looking out

9

When doing query never trust input data.
Instead of:

$sql = "SELECT password FROM users WHERE username = '".$username."'";

Do this:

$sql = "SELECT `password` FROM `users` WHERE `username` = '".mysqli_real_escape_string($username)."'";

I suggest to use REST instead of plain text, and suppress errors/warning like @mysqli_query.
Instead of superglobals ($_POST) use filter_input for cleaning data from unwanted characters.