Hi!

I'm doing a small website with some mysql and php, and have difficulties with doing a login site. I have the form sending the username and password, and this site should check them.

Here's the code:

[php]

<?php

session_start();

if(!($connection = mysql_connect("host","user","pass")))
die("Can't connect to database.");
if(!(mysql_select_db("db", $connection)))
die("ERROR ".mysql_errno($connection)."-". mysql_error($connection));

if(isset($_POST["username"]) AND isset($_POST["password"])) {
$uname = $_POST["username"];
$pword = $_POST["password"];


$loginquery = "SELECT * FROM Users WHERE Username = '{$uname}' AND Password = '{$pword}' ORDER BY UserID";
if(!$loginresult = mysql_query($loginquery, $connection))
$error = "No connection.";

if (mysql_num_rows($loginresult) != 1){
$error .= "Username / password error!";
}
else {
$datas = mysql_fetch_assoc($loginresult);
$uid2 = $datas["UserID"];
$uname2 = $datas["Username"];
$pword2 = $datas["Userpassword"];
$artist2 = $datas["Artist"];
$moderator2 = $datas["Moderator"];

$_SESSION["userid"] = $uid2;
$_SESSION["username"] = $uname2;
$_SESSION["password"] = $pword2;
$_SESSION["artist"] = $artist2;
$_SESSION["moderator"] = $moderator2;
}

}
?>
[/php]
This php page is included in every page on the site. Some variables may be named badly, ignore them. Just help me, please?

[php]

$loginquery = "SELECT * FROM Users WHERE Username = '{$uname}' AND Password = '{$pword}' ORDER BY UserID";
if(!$loginresult = mysql_query($loginquery, $connection))
$error = "No connection.";

if (mysql_num_rows($loginresult) != 1){
$error .= "Username / password error!";
}
[/php]

You can try to modify the coding above as below. See whether it works or not.

[php]
$loginquery = mysql_query("SELECT * FROM Users WHERE Username = '$uname' AND Password = '$pword' ORDER BY UserID");

if (!$loginquery){$error="Query problem";}

if (mysql_num_rows($loginquery) != 1){
$error .= "Username / password error!";
}
[/php]

No, didn't help. Thanks for trying though.

Still not working. Does anyone have any idea what the problem is? I really should get this done quite soon and thought it would be easy, since I've done a similar site previously and had no problems... Pretty please?

FIXED IT! :mrgreen:

Or actually didn't fix it, just did something else. Here's the code if someone's wondering.

Before:

[php]
$loginquery = "SELECT * FROM Users WHERE Username = '{$uname}' AND Password = '{$pword}' ORDER BY UserID";
if(!$loginresult = mysql_query($loginquery, $connection))
$error = "No connection.";

if (mysql_num_rows($loginresult) != 1){
$error .= "Username / password error!";
}
else {
$datas = mysql_fetch_assoc($loginresult);
$uid2 = $datas["UserID"];
$uname2 = $datas["Username"];
$pword2 = $datas["Userpassword"];
$artist2 = $datas["Artist"];
$moderator2 = $datas["Moderator"];

$_SESSION["userid"] = $uid2;
$_SESSION["username"] = $uname2;
$_SESSION["password"] = $pword2;
$_SESSION["artist"] = $artist2;
$_SESSION["moderator"] = $moderator2;
}
[/php]
After:
[php]
$loginquery = "SELECT * FROM Users ORDER BY UserID";
$loginresult = mysql_query($loginquery);

while($row = mysql_fetch_assoc($loginresult)){
if($row[Username]==$uname && $row[Userpassword]==$pword){
$_SESSION["userid"] = $row[UserID];
$_SESSION["username"] = $row[Username];
$_SESSION["password"] = $row[Userpassword];
$_SESSION["artist"] = $row[Artist];
$_SESSION["moderator"] = $row[Moderator];
}
}
[/php]

Instead of:
[php]
$loginquery = "SELECT * FROM Users WHERE Username = '{$uname}' AND Password = '{$pword}' ORDER BY UserID";

if(!$loginresult = mysql_query($loginquery, $connection))
$error = "No connection.";

if (mysql_num_rows($loginresult) != 1){
$error .= "Username / password error!";
}[/php]

Try this:

[php]
$loginquery = mysql_query("SELECT * FROM Users WHERE Username = '".$uname."' AND Password = '".$pword."' ORDER BY UserID");

if (!$loginquery){$error="Query problem";}

if (mysql_num_rows($loginquery) != 1){
$error .= "Username / password error!";
}[/php]

Or, change the !=1 to <1 as there shouldn't be more than two usernames that are the same.

The other way is to go through phpMyAdmin and paste it into SQL Query. It (usually) tells you the why it won't work, or at least where it thinks the error is.

Thanks for putting up your work around.

...and why using AND operator, not use && operator?

Is there a difference?

Yes, && is evaluated first.

From: http://us2.php.net/manual/en/language.operators.php
The next comment also points out that relying on order of operations is a good way to produce bugs and errors.

Just a quick thought, you are not filtering any input from the login form. If I happened to put my user name as (delete * from users where 1), all of your user information would dissappear.

I suggest that you run your input data through at least htmlentities, this would convert the perens and astrix to their ascii equivilent.

Also, just semantics, you could put your data into an array and then store that array in the $_SESSION

Just one of many ways to do this.