Q:

PHP Login Form. Always wrong email, password

I'm having a little problem. I don't really know what I did wrong. I changed my Code from the deprecated php5 to php7 but after it. The Login doesnt work, as it should be 
if(isset($_POST['is_login'])){
    $sql = "SELECT * FROM ".$SETTINGS["USERS"]." WHERE `email` = '".mysqli_real_escape_string($_POST['email'])."' AND `password` = '".mysqli_real_escape_string($_POST['password'])."'";
    $sql_result = mysqli_query ($connection,$sql) or die ('request "Could not execute SQL query" '.$sql);
    $user = mysqli_fetch_assoc($sql_result);
    if(!empty($user)){
        $_SESSION['panel'] = $user;
        $query = " UPDATE ".$SETTINGS["USERS"]." SET last_login = NOW() WHERE id=".$user['id'];
        mysqli_query ($connection,$query ) or die ('request "Could not execute SQL query" '.$query);
    }
    else{
  $error = 'Wrong email or password.';

The last Statement $error = 'Wrong email or password.'; is always being called. Thanks for help. 

A:

The reason is that mysqli_real_escape_string() requires a database connection be passed as the first argument.

http://php.net/manual/en/mysqli.real-escape-string.php

Better than that, use a prepared statement and do away with those pesky function/db calls.

http://php.net/manual/en/mysqli.quickstart.prepared-statements.php

Do keep in mind that if you intend on going live with this or are live, then use a safe hashing method such as password_hash(). I'm sure you'll like to keep your database intact.

password_hash() http://php.net/manual/en/function.password-hash.php

Debugging:
Using mysqli_error() on the query would have helped you during your transition.

http://php.net/manual/en/mysqli.error-list.php

Bit of a side note: if and when you decide to safely store passwords, remember to not use any escaping methods against passwords. One such as this 123'\abc<BR> would be considered as being valid. But by escaping it, that would be interpreted as 123\'\abc<BR> in turn rendering your verification method for it "null & void", and would fail silently because of it embedding the slash/escape quote in the hash. Both password_hash() and password_verify() take that into account.

password_verify() http://php.net/manual/en/function.password-verify.php

