title: Is it possible to select the exact password to a username in a database?
body: <p>I have created a database with a table (<code>UserPass</code>) which essentially stores Usernames and Passwords.</p>
  
  <p>Now in my form I want to ask a user to input his username and password and while testing this, I realized that I can input any username from the database and any password to login.</p>
  
  <p>Is it possible to select in the SQL query the password that is in the same line as the username?</p>
  
  <p>I tried something like:</p>
  
  <pre><code>$username = $_POST['username'];
  $sql = "SELECT Password FROM UserPass WHERE Username = $username";
  </code></pre>
  
  <p>But the following <code>mysqli_query</code> failed:</p>
  
  <pre><code>$query = mysqli_query($cxn, $sql);
  </code></pre>
  
  <p>So here is the entire <code>action.php</code> script:</p>
  
  <pre><code>&lt;?php
  include "info.php";
  include "god.php";
  session_start();
  if($_POST['god'] == $god)
  {   
  
      header( "refresh:0;url=../web.html" );
  }
  
  else if(empty($_POST['god']))
  {
  
  }
  
  else 
  {
      echo "Can't you read: DON'T TRY!!!!!!!";
      exit();
  }
  
  $cxn = mysqli_connect($host, $user, $password, $dbname) or die("Go");
  //check username
  $userI = $_POST["username"];
  $userSql = "SELECT Username FROM UserPass ";
  $result = mysqli_query($cxn, $userSql) or die("Query failed!");
  while($line = mysqli_fetch_assoc($result))
  {
      extract($line);
  
      foreach ($line as $key =&gt; $val)
      {
          if($_POST['username'] == $val)
          {
              //check for password 
              $username = $_POST['username'];
              $pass = $_POST['password'];
              $sql = "SELECT Password FROM UserPass";
              $passres = mysqli_query($cxn, $sql) or die("Request cannot be handled now.");
              while ($passline = mysqli_fetch_assoc($passres))
              {
                  extract($passline);
                  foreach ($passline as $k =&gt; $v) 
                  {
                      if($_POST['password'] == $v)
                      {
                          header( "refresh:0;url=../web.html");
  
  
                      }
  
                      else 
                      {
                          session_destroy();
                      }
  
                  }
              }
  
          }
      }
  }
  /*
  if($userI == $line['Username'])
  {
      //check for password
      $pass = $_POST['password'];
      $sql = "SELECT * FROM UserPass";
      $res = mysqli_query($cxn, $sql) or die("Pass query failed");
      $passline = mysqli_fetch_assoc($res);
      if($pass == $passline['Password'])
      {
          header( "refresh:4;url=../web.html");
          session_start();
          echo "Login succesful, session started, session id: ";
      }
  }
  */
  
  
      /*
      if($_POST['username'] == $val)
      {
          //check for password
          $b = $_POST['username'];
          $pass = $_POST['password'];
          $sql = "SELECT * FROM UserPass";
          $passres = mysqli_query($cxn, $sql);
          $passline = mysqli_fetch_row($passres);
          foreach ($passline as $k =&gt; $v ) 
          {
              if($_POST['password'] == $v)
              {
                  header( "refresh:0;url=../web.html");
                  session_start();
              }
          }
  
  
      }
      */
      /*
      else 
      {
          print("Destroying Laptop...US Government...Destroying Laptop...\n");
          exit();
      }
      */              
  ?&gt;
  </code></pre>