Member Avatar for sacarias40

i cant see an error

<?PHP

session_start();

if (isset($_POST['Submit'])) {

	$email = $_POST['email'];
	$password = $_POST['password'];
	
	if (isset($email) && isset($password)) {

	$handle = mysql_connect("localhost","root","");
		mysql_select_db("man_of_honor");
		

		$safe_email = sql_safe($email,$handle);
		$safe_password = md5(sql_safe($password,$handle));
	
		
		$login_query = "SELECT * 
						FROM moh_members 
						WHERE email = '".$safe_email."' AND password = '".$safe_passwd."'";
							
		$result = mysql_query($login_query);
		$num_rows = mysql_num_rows($result);
		
		if ($num_rows == 1) {
			 // Login Valid
			
			$resultArr = mysql_fetch_array($result);
			$username = $resultArr['username'];
			$_SESSION['user'] = $username;
			
			mysql_query("UPDATE moh_members SET active = '1' WHERE username = '".$_SESSION['user']."'");
			
			$active = $resultArr['active'];
			$_SESSION['user'] = $active;
			
			header("location: member_area.php");
			
		} else {

			if ($num_rows > 1) {
				// Multi-Accounts
			} elseif ($num_rows == 0) {
				// No User Exists
				header("location: index.php");
				alert("No User With These Credentials Exists");
				
			}
		}
	}
}

function sql_safe($str,$lnk) {
	return mysql_real_escape_string(trim($str),$lnk);
}

function alert($str) {
	echo "<script type='text/javascript'>alert('".$str."');</script>";
}

?>
  • 3 Contributors
  • 3 Replies
  • 122 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by superchris

Dani AI

Generated

The symptom you described — the script always hitting the "No User With These Credentials Exists" branch — points to a few concrete problems in the posted code and some common pitfalls. The quickest, most likely fixes are below, followed by a short troubleshooting checklist and a couple of security notes.

First, concrete bugs to fix (these explain why the SELECT returns nothing):

  • A variable name mismatch: the query uses the wrong variable ($safe_passwd vs the computed $safe_password). Fixing that alone will likely make the SELECT find rows.
  • Session clobbering: the code sets $_SESSION['user'] to the username and then immediately overwrites it with the active flag. Keep them separate.
  • Redirect/output ordering: calling header() after producing output (or echoing an alert) and not calling exit can break redirects or prevent expected behavior.

Small example of minimal corrections (showing only the changed lines):

$login_query = "SELECT * FROM moh_members WHERE email = '" . $safe_email .
               "' AND password = '" . $safe_password . "'";

$_SESSION['user'] = $username;
mysql_query("UPDATE moh_members SET active = '1' WHERE username = '" . $username . "'");
$_SESSION['active'] = $active;
exit;

Troubleshooting checklist (easy to run now):

  • Echo or log the final SQL string, then paste it into MySQL client to verify results.
  • Replace mysql_query(...) temporarily with mysql_query(...) or die(mysql_error()); to see DB errors.
  • Verify the DB actually stores MD5 hashes (32 chars). If it stores plain text or another hash, the comparison will fail.
  • Use !empty() rather than isset() to ensure non-empty inputs.
  • Check the form: confirm the submit button name matches $_POST['Submit'] or use $_SERVER['REQUEST_METHOD'] === 'POST'.

Longer-term: move off deprecated mysql_* functions to mysqli or PDO and switch from MD5 to password_hash()/password_verify() for secure password storage. Also enforce a UNIQUE constraint on the email column (answers ) so num_rows > 1 cannot happen silently. This addresses both the immediate bug and hardens the code.

Recommended Answers

All 3 Replies

Member Avatar for almostbob

proof read looking for what
what errors is it kicking
what is the table structure its supposed to be accessing

what are you intending to do if $num_rows > 1

Member Avatar for sacarias40

it makes it all the way to the part where it cannot find any users with these credentials and therefore nobody gets logged in

Member Avatar for superchris

Might be better posted to the PHP board :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.