Untitled


<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <meta name="description" content="">
    <meta name="author" content="">
    <link rel="icon" href="../../favicon.ico">

    <title>SQL Injection</title>

    <!-- Bootstrap core CSS -->
    <link href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" rel="stylesheet">

    <!-- Custom styles for this template -->
    <link href="signin.css" rel="stylesheet">
  </head>

  <body>

    <div class="container">

      <form class="form-signin" method="POST">

      <?php
          if(isset($_POST['username']))
          {
              $username = $_POST['username'];
              $password = $_POST['password'];
              $con = mysqli_connect('localhost','root','password','sample');
              $result = mysqli_query($con, "SELECT * FROM `users` WHERE username='$username' AND password='$password'");
              if(mysqli_num_rows($result) == 0)
                  echo 'Invalid username or password';
              else
                  echo '<h2>Logged in</h2><p>A Secret for you....</p>';
          }
          else
          {
      ?>
        <h2 class="form-signin-heading">Please sign in</h2>
        <label for="inputEmail" class="sr-only">Username</label>
        <input type="text" name="username" id="inputEmail" class="form-control" placeholder="Username" required autofocus>
        <label for="inputPassword" class="sr-only">Password</label>
        <input type="password" name="password" id="inputPassword" class="form-control" placeholder="Password" required>
        <button class="btn btn-lg btn-primary btn-block" name="submit" type="submit">Sign in</button>

        <?php
          }
        ?>
      </form>

    </div> <!-- /container -->
  </body>
</html>