# How to create a login route with slim

**URL:** <https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158>\
**Category:** Questions\
**Created:** [January 12, 2018, 10:26am UTC](https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158 "2018-01-12T10:26:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaimec14](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jaimec14](https://discourse.slimframework.com/u/jaimec14)\
**Post date:** [January 12, 2018, 10:26am UTC](https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158/1 "2018-01-12T10:26:35Z")

</div>

Hey, so I am new to Slim Framework and PHP aswell, What I am trying to do is to create a route that validates if the user trying to login actually exists, this is what i have so far

```
    $app->post('/login', function ($request, $response, $args) {
    $usuario = ($POST['usuario']);
    $input = $request->getParsedBody();
    $sth = $this->db->prepare("SELECT * FROM aldroges8.oficina_virtual_usuarios WHERE 
    usuario='".$usuario."'");
    $result = $sth->execute();

    $row_cnt = $result->num_rows;
    if ($row_cnt>0){
      return $this->response->withJson(array("ok"=>"acceso autorizado"));

    }else{
      return $this->response->withJson(array("error"=>"acceso negado"));

    }
    });

```

And i tried doing (user in the database) but returns error  
curl [http://localhost:8080/login](http://localhost:8080/login) -d"usuario=sara"

so anybody can give me a hand on why this is not working?

EDIT:  
I did it, i have it now working.

Now i have another question, If I want to add JWT auth, how to I return a token if the user login was successful?

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [January 12, 2018, 11:33am UTC](https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158/2 "2018-01-12T11:33:28Z")

</div>

> [@jaimec14](#):
>
> $usuario = $POST[‘usuario’];  
> $sth = $this-\>db-\>prepare(“SELECT \* FROM aldroges8.oficina\_virtual\_usuarios WHERE  
> usuario='”.$usuario.“'”);

Beware of SQL injections!

> If I want to add JWT auth, how to I return a token if the user login was successful?

It depends. Return it from your server however you want to return it. For example in a HTTP response header or/and in a JSON value.

```php
$response = $response->withHeader('Authorization', 'Bearer ' . $token);

```

[https://jwt.io/introduction/](https://jwt.io/introduction/)

---

<div class="post-metadata">

**Author:** ![jaimec14](https://avatars.discourse-cdn.com/v4/letter/j/3be4f8/32.png) [@jaimec14](https://discourse.slimframework.com/u/jaimec14)\
**Post date:** [January 12, 2018, 11:50am UTC](https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158/3 "2018-01-12T11:50:46Z")

</div>

> Beware of SQL injections!

Do i avoid SQL injections with this way?

```
      $sth = $this->db->prepare("SELECT * FROM aldroges8.oficina_virtual_usuarios WHERE 
      usuario=:usuario");

```

And thanks, I’ll take a look to the documentation

---

<div class="post-metadata">

**Author:** ![odan](https://avatars.discourse-cdn.com/v4/letter/o/9de053/32.png) [@odan](https://discourse.slimframework.com/u/odan)\
**Post date:** [January 12, 2018, 1:59pm UTC](https://discourse.slimframework.com/t/how-to-create-a-login-route-with-slim/2158/4 "2018-01-12T13:59:07Z")

</div>

> Do i avoid SQL injections with this way?

Prepared statements are good for solving the SQL Injection problem. This works quite good for simple statements. But if you have a lot of “dynamic” SQL queries then better use a SQL Query Builder (e.g. [illuminate/database](https://github.com/illuminate/database))