Nrthugu

I'm trying to do an execution of a query and see if it goes well, but right now it doesn't enter the IF or ELSE.
I had it on mysqli procedural and all worked flawlessy now I'm trying to change it to object oriented and it won't enter inside if/else.

        if(isset($_POST['submit']))

{

    $email = $_POST["email"]; 

    $password = md5($_POST["password"]); 



    $query = "SELECT * FROM Users WHERE Email=? AND Password=?";

    $stmt = $conn->prepare($query);

    $stmt->bind_param('ss', $email,$password);

    $stmt->execute();

    $result = $stmt->get_result();



    if ($result->num_rows == 1)

    {

            ?>

            <script type="text/javascript">

                alert("INSIDE");

            </script>

        <?php

        $row = $result->fetch_assoc();

        if(isset($_POST['remember']))

        {

            $_SESSION["remember"] = "1"; 

        }

        $_SESSION["username"] = $row['Username'];

        $_SESSION['check'] = "1";

        $_SESSION['ID'] = $id;

        $_SESSION['permission'] = $row['Admin'];

        header("Location: dashboard.php");

        exit;

    } 

    else

    {

        ?>

            <script type="text/javascript">

                alert("Credentials Are Wrong!");

            </script>

        <?php

        exit;

    }

    $stmt->close();

}   

Thank you all.

You should be using

$stmt->bind_result($col1, $col2 ...);

and

$result = $stmt->fetch();

in order to access the data from the query, rather than

$conn->query($stmt);

(an example is provided at https://secure.php.net/manual/en/mysqli-stmt.fetch.php). Note that for this to work you will need to specify the column names you want to fetch from the database, rather than using * in your SQL query, and for each column data is fetched from in the query, you should have a variable for in the fetch() parameters, so for example, something as follows should work (note these may not match the names of your database columns):

$email = $_POST["email"]; 

$password = md5($_POST["password"]); 



$stmt = $conn->prepare("SELECT ID, Name FROM Users WHERE Email=? AND Password=?");

$stmt->bind_param('ss', $email, $password);

$stmt->execute();

$stmt->bind_result($id, $name);

$stmt->fetch();

$stmt->close();

echo $id . ': ' . $name;

Updated Answer

You are very close. Use $result = $stmt->get_result(); instead of $result = $stmt->query; to check to see if the query returned a result or not.

$email = $_POST["email"]; 

$password = md5($_POST["password"]);     



$query = "SELECT * FROM Users WHERE Email = ? AND Password = ?";

$stmt = $conn->prepare($query);

$stmt->bind_param('ss', $email, $password);

$stmt->execute();

$result = $stmt->get_result();



if($result->num_rows !== 0){



  if(isset($_POST['remember'])){

    $_SESSION["remember"] = "1"; 

  }



  $_SESSION['check'] = "1";

  $_SESSION['ID'] = $row['ID'];

  header("Location: dashboard.php");

  exit();



}else{



  echo

  '<script type="text/javascript">

    alert("Credentials Are Wrong!");

  </script>';



  exit();



  }



$stmt->close();

As several have already stated in their comments do not use MD5 for password hashes. PHP has it's own built in functions for handling passwords. Please research Password_has() and Password_verify(). Spend the time to research and implement these now instead of later. It will save you time.