Return to Answer

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

   // good practice
   if (isset($userName, $userPass))
   // bad practice
   if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

   // good practice
   if (isset($userName, $userPass))
   // bad practice
   if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

   // good practice
   if (isset($userName, $userPass))
   // bad practice
   if ($userName && $userPass )
  

• Split the connection phase and call die if you cannot connect.

   // bad practice
   $con = mysqli_connect($IP, $user, $pass, $db);
   // good practice
   mysql_connect("$host", "$username", "$password")or die("cannot connect");
   mysql_select_db("$db_name")or die("cannot select DB");
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6

At a quick look:

• Your code is vulnerable to SQL Injection: assume the user wants to hurt you, so always parse superglobals $_GET and $_POST

  http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

• To check if variable have values:

   // good practice
   if (isset($userName, $userPass))
   // bad practice
   if ($userName && $userPass )
  

• More important:

Don't reinvent the wheel unless you plan on learning more about wheels.

A simple search on google for PHP login system will give you a limitless number of examples from where you can learn how to build a proper system:

http://www.phpeasystep.com/workshopview.php?id=6