PHP-синтаксис с использованием запросов и PDO

Question

Я пытаюсь создать файл входа php, который запрашивает мою базу данных SQL для правильного имени пользователя и пароля. Мой checklogin.php, кажется, висит, когда я вызываю свой метод от dao.php. У меня есть register.php, который отлично работает с моим dao.php. Ниже приведен весь мой код. Я считаю, что моя проблема исходит от функции getUser() в dao.php.

checklogin.php: 

    <?php 
    require_once "DAO.php"; 
    $dao = new DAO(); 

    // Get data from form POST 
    $username = (isset($_POST["username"])) ? $_POST["username"] : ""; 
    $password = (isset($_POST["password"])) ? $_POST["password"] : ""; 

    // MySQL Injection Protection Section (the rhymez) 
    $username = stripslashes($username); 
    $password = stripslashes($password); 

    $username = mysql_real_escape_string($username); 
    $password = mysql_real_escape_string($password); 
    // End protection 

    //echo $username; 
    //echo $password; 
    //echo $dao->getUser($username, $password); 

    if(!$dao->getUser($username, $password)){ 
    //echo "Wrong usernamer or password"; 
    header("location: login.html"); 
    } 
    else{ 
    //echo "Logic successful"; 
    header("location: index.php"); 
    } 
?> 

dao.php:

<?php 
    class DAO { 
     private $host = "localhost"; 
     private $db = "webdev"; 
     private $user = "root"; 
     private $pass = "secret"; 

     public function getConnection() { 
     //echo "hello"; 
     try { 
     $dbh = new PDO("mysql:host={$this->host};dbname={$this->db}", $this->user,$this->pass); 
     } catch (PDOException $e) { 
      echo 'Connection failed: ' . $e->getMessage(); 
     } 
     //echo "success"; 
     return $dbh; 
     } 

     public function registerUser($username, $password, $email, $name) { 
     $conn = $this->getConnection(); 
     $saveQuery = "INSERT INTO users(login, pass, email, fname) VALUES (:username, :password, :email, :name)"; 
     $q = $conn->prepare($saveQuery); 
     $q->bindParam(":username", $username); 
     $q->bindParam(":password", $password); 
     $q->bindParam(":email", $email); 
     $q->bindParam(":name", $name); 
     $q->execute(); 
     } 

     public function getUser($username, $password){ 
     $conn = $this->getConnection(); 
     $getQuery = "SELECT login FROM users where login=:username and pass=:password"; 
     $q = $conn->prepare($getQuery); 
     $q->bindParam(":username" $username); 
     $q->bindParam(":password", $password); 
     $q->execute(); 

     //$conn->query($getQuery); 
     $count = $q->fetch(PDO::FETCH_NUM); 
     if($count == 1){ 
      echo "hi"; 
      session_register(":username"); 
      return true; 
     } 
     else{ 
      echo "hi"; 
      return false; 
     } 
     } 
    } // end Dao 
    ?> 

register.php:

<?php 
    require_once "DAO.php"; 
    $dao = new DAO(); 

    // Get data from form POST 
    $username = (isset($_POST["username"])) ? $_POST["username"] : die('Error: Username/Password field was blank'); 
    $password = (isset($_POST["password"])) ? $_POST["password"] : header("location: index.php"); 
    $email = (isset($_POST["email"])) ? $_POST["email"] : ""; 
    $name = (isset($_POST["name"])) ? $_POST["name"] : ""; 

    // MySQL Injection Protection Section (the rhymez) 
    $username = stripslashes($username); 
    $password = stripslashes($password); 
    $email = stripslashes($email); 
    $name = stripslashes($name); 

    $username = mysql_real_escape_string($username); 
    $password = mysql_real_escape_string($password); 
    $email = mysql_real_escape_string($email); 
    $name = mysql_real_escape_string($name); 
    // End protection 

    $dao->registerUser($username, $password, $email, $name); 
    header("location: appointment.php"); 
?> 

EDIT (решить ее): Фигурные его. Я использовал бит из кода вашего общего смысла, чтобы решить эту проблему.

getUser function: 

     public function getUser($username, $password){ 
     $conn = $this->getConnection(); 
     $getQuery = "SELECT login FROM users WHERE login=:username AND pass=:password"; 
     $q = $conn->prepare($getQuery); 
     $q->bindParam(":username", $username); 
     $q->bindParam(":password", $password); 
     $q->execute(); 

     $rows = $q->fetchAll(); 
     return empty($rows); // True if account doesn't exist 
     } 

checklogin.php:

<?php 
     require_once "DAO.php"; 
     $dao = new DAO(); 

     // Get data from form POST 
     $username = (isset($_POST["username"])) ? $_POST["username"] : ""; 
     $password = (isset($_POST["password"])) ? $_POST["password"] : ""; 

     // MySQL Injection Protection Section (the rhymez) 
     $username = stripslashes($username); 
     $password = stripslashes($password); 
     // End protection 

     // Failure 
     if($dao->getUser($username, $password)){ 
     header("location: login.html"); 
     } 
     // Successful login 
     else{ 
     header("location: index.php"); 
     } 
    ?> 

Спасибо за помощь, ребята.

Answer 1

С этим кодом НЕ ТАКОЕ, что потребуется неделя, чтобы объяснить все ошибки, неправильные методы и суеверия. Так, только код

class DAO { 

    function __construct($pdo) { 
    $this->db = $pdo; 
    } 

    public function registerUser($username, $password, $email, $name) { 
    $sql = "INSERT INTO users(login, pass, email, fname) VALUES (?, ?, ?, ?)"; 
    $stm = $this->db->prepare($sql); 
    $stm->execute(func_get_args()); 
    } 

    public function getUser($username, $password){ 
    $sql = "SELECT id,password FROM users where login=?"; 
    $stm = $this->db->prepare($sql); 
    $stm->execute([$username]); 
    $row = $stm->fetch(); 
    if (password_verify($password, $row['password'])) { 
     $_SESSION['user'] = $row['id']; 
     return TRUE; 
    } 
    } 
} 

checklogin.php:

<?php 
require_once "DAO.php"; 
require_once "pdo.php"; 
$dao = new DAO($pdo); 

if(isset($_POST["username"]) && $dao->getUser($_POST["username"], $_POST["password"])) 
{ 
    header("location: index.php"); 

} else { 

    header("location: login.html"); 
} 

register.php:

<?php 
require_once "DAO.php"; 
require_once "pdo.php"; 
$dao = new DAO(); 

// this section is flawed too but I can't write ALL the app 
$username = (isset($_POST["username"])) ? $_POST["username"] : die('Error: Username/Password field was blank'); 
$password = (isset($_POST["password"])) ? $_POST["password"] : header("location: index.php"); 
$email = (isset($_POST["email"])) ? $_POST["email"] : ""; 
$name = (isset($_POST["name"])) ? $_POST["name"] : ""; 

$dao->registerUser($username, $password, $email, $name); 
header("location: appointment.php"); 

pdo.php

$dsn = "mysql:host=localhost;dbname=webdev;charset=utf8"; 
$opt = array(
    PDO::ATTR_ERRMODE   => PDO::ERRMODE_EXCEPTION, 
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC 
); 
$pdo = new PDO($dsn,'root','secret', $opt);