View difference between Paste ID: ht7m7FYg and g3zycX03

 <?php
-$sambung=mysqli_connect("localhost","root","","login");
+$koneksi_database = mysqli_connect("localhost", "root", "", "login");
-$user=$_POST['user'];
+
-$pass=$_POST['password'];
+if ( isset($_POST['user']) && isset($_POST['password']) ) {
-$cari=mysqli_query($sambung,"select * from login_admin where user_name='$user' and user_pass='$pass'") or die ("Gagal");
+	$user = $_POST['user'];
-$lihat=mysqli_num_rows($cari);
+	$pass = $_POST['password'];
-if (isset($_POST['submit']))
+
-{
+    $stmt = mysqli_prepare($koneksi_database, "select * from login_admin where user_name=?");
-if (empty($user) and empty($pass))
+	mysqli_stmt_bind_param($stmt, 's', $user);
-{
+	mysqli_stmt_execute($stmt);
 	$result = mysqli_stmt_get_result($stmt);
 	if ( $row = mysqli_fetch_array($result, MYSQLI_ASSOC) ) {
-elseif ($lihat<1) {
+		//cek password di database, asumsi sudah pakai password_hash saat menyimpan password
-	echo "Username dan Password Salah";
+		if ( password_verify($pass, $row['user_pass']) ) {
 			session_start();
-else
+			$_SESSION['user_id'] = $row['id'];
-{
+			header("location:admin.php");
-session_start();
+			exit(0); // memastikan kode berhenti di titik ini.
-$_SESSION['password']=$pass;
+		}
-header("location:admin.php");
+	}
 	// jika tidak ada data, atau password tidak cocok, maka akan sampai ke titik ini.
     // best practice: jangan beritahu secara tepat bahwa username yg salah atau password yg salah
-?>
+	echo "Username dan/atau Password salah!";
 }
 else {
 	echo "User name dan Password tidak boleh kosong";
 }