php login help

Question

BigDan531 0 Newbie Poster

14 Years Ago

hi guys i need some help with my code
im new to php and im trying to create a login page.
i have created MYSQL database to go along but whenever i try to login - it brings me to myaccount.php and just displays Access Denied no matter what input, be it in the database or just plain rubbish.
Hope you guys can help me out as ive been messing around with it for a day :$

<?php 
include 'dbc.php';

$user_name = mysql_real_escape_string($_POST['name']);

if ($_POST['Submit']=='Login')
{
$md5pass = md5($_POST['pwd']);
$sql = "SELECT user_pwd FROM users WHERE 
            user_name = '$_POST[user_name]'"; 
			
$result = mysql_query($sql) or die (mysql_error());
    if ( $result = $md5pass ) 
	{ 
   // A matching row was found - the user is authenticated.
       session_start();
      list($md5pass,$user_name) = mysql_fetch_row($result);
      // this sets variables in the session
      $_SESSION['user']= $user_name;

		
		if (isset($_GET['ret']) && !empty($_GET['ret']))
      {
      header("Location: $_GET[ret]");
      exit();
      } else
      {
      header("Location: myaccount.php");
      exit();
      }
      //echo "Logged in...";
      exit();
  }

header("Location: login.php?msg=Invalid Login");
//echo "Error:";
exit();		
}

?>

<link href="styles.css" rel="stylesheet" type="text/css">

<?php if (isset($_GET['msg'])) { echo "<div class=\"msg\"> $_GET[msg] </div>"; } ?>


<p>&nbsp;</p><table width="40%" border="0" align="center" cellpadding="0" cellspacing="0">
  <tr> 
    <td bgcolor="#d5e8f9" class="mnuheader" >
<div align="center"><font size="5"><strong>Login 
        Members</strong></font></div></td>
  </tr>
  <tr> 
    <td bgcolor="#e5ecf9" class="mnubody"><form name="form1" method="post" action="">
        <p>&nbsp;</p>
        <p align="center">Username 
          <input name="username" type="text" id="user_name">
        </p>
        <p align="center"> Password: 
          <input name="pwd" type="password" id="pwd">
        </p>
        <p align="center"> 
          <input type="submit" name="Submit" value="Login">
        </p>
        <p align="center"><a href="register.php">Register</a> | <a href="forgot.php">Forgot</a></p>
      </form></td>
  </tr>
</table>

<?php
session_start();
if (!isset($_SESSION['user']))
{
 die ("Access Denied");
}
?> 
<h2>My Account </h2>
<?php if (isset($_SESSION['user'])) { ?>
<p>Logged as <?php echo $_SESSION['user']; ?> | <a href="settings.php">Settings</a> 
  | <a href="logout.php">Logout</a> </p>
<?php } ?>

php

3 Contributors
7 Replies
93 Views
3 Days Discussion Span
Latest Post 14 Years Ago Latest Post by pritaeas

All 7 Replies

pritaeas 2,194 ¯\_(ツ)_/¯

14 Years Ago

Change:

$result = mysql_query($sql) or die (mysql_error());
if ( $result = $md5pass ) {
    // ...

To:

$result = mysql_query($sql) or die (mysql_error());
if ($result) {
    $record = mysql_fetch_assoc($result);
    if ( $record['user_pwd '] == $md5pass ) {
        // ...
}

Menster 38 Junior Poster

14 Years Ago

Hi there,
The problem is where you are checking your $result against the $md5Pass, what you are doing is running the query and storing the result set in $result, but we aren't done yet, that $result only contains a pointer to a result set in memory and not the actual results (data). You need to add this to your code:

$md5pass = md5($_POST['pwd']);
$sql = "SELECT user_pwd FROM users WHERE 
            user_name = '$_POST[user_name]'"; 
			
$result = mysql_query($sql) or die (mysql_error());
$row = mysql_fetch_array($result);
$password_in_db = $row['user_pwd'];
    if ( $password_in_db == $md5pass ) 
	{ 
   // A matching row was found - the user is authenticated.

P.S remember, when comparing values in an if expression always use two (sometimes three) equals signs, using a single equals sign will assign one value to the other and not compare them.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

BigDan531 0 Newbie Poster · Answer 1 · 2009-07-24T14:45:12+00:00

thanks for your replies.
i have changed my code to the one below.
but im back to the problem of being directed to myaccount.php no matter what i type in. any ideas?

<?php 
include 'dbc.php';

	if ($_POST['Submit']=='Login')
	{
		$md5pass = md5($_POST['pwd']);
		$sql = "SELECT user_pwd FROM users WHERE user_name = '$_POST[user_name]'"; 
		$result = mysql_query($sql) or die (mysql_error());
		$row = mysql_fetch_array($result);
		$password_in_db = $row['user_pwd'];
		
			if ($password_in_db == $md5pass) 	
			{ 
		 	  	// A matching row was found - the user is authenticated.
			   	session_start();
		     	list($md5pass,$user_name) = mysql_fetch_row($result);
		     	// this sets variables in the session
		      	$_SESSION['user_name']= $user_name;
	      	}
  			echo "Logged in...";
 		  header("Location: myaccount.php");
   		   exit();
	  }


?>

<?php
session_start();
if (!isset($_SESSION['user_name']))
{
 die ("Access Denied");
}
?> 
<h2>My Account </h2>
<?php if (isset($_SESSION['user_name'])) { ?>
<p>Logged as <?php echo $_SESSION['user_name']; ?> | <a href="settings.php">Settings</a> 
  | <a href="logout.php">Logout</a> </p>
<?php } ?>

Menster 38 Junior Poster · Answer 2 · 2009-07-24T15:18:06+00:00

Well, the way your code is structured (in the first snippet), if $_POST == 'Login', the user will always be redirected to myaccount.php, if you only want that to happen if the login fails, then you must put it into and else statement like this:

if ($_POST['Submit']=='Login')
	{
		$md5pass = md5($_POST['pwd']);
		$sql = "SELECT user_pwd FROM users WHERE user_name = '$_POST[user_name]'"; 
		$result = mysql_query($sql) or die (mysql_error());
		$row = mysql_fetch_array($result);
		$password_in_db = $row['user_pwd'];
		
			if ($password_in_db == $md5pass) 	
			{ 
		 	  	// A matching row was found - the user is authenticated.
			   	session_start();
		     	list($md5pass,$user_name) = mysql_fetch_row($result);
		     	// this sets variables in the session
		      	$_SESSION['user_name']= $user_name;

                        echo "Logged in..."; 
	      	      } else {
  			   header("Location: myaccount.php");
               		   exit();
                      }
                   //Carry on with what would happen after a succesful login here
	  }

pritaeas 2,194 ¯\_(ツ)_/¯ Moderator Featured Poster · Answer 3 · 2009-07-24T16:01:23+00:00

echo your query before you execute it, and run it in phpmyadmin. just to check.

BigDan531 0 Newbie Poster · Answer 4 · 2009-07-27T13:43:03+00:00

okay guys thanks for all your help ive got the first part working already =) but ive got another problem. ive modified myaccount.php to list a button. When the user clicks the button it will link the user to another page called keyinput.php.

<?php session_start(); 


if (!isset($_SESSION['user_name']))
{
 die ("Access Denied");
}
?>
<?php if (isset($_SESSION['user_name'])) { ?>
<p>&nbsp;</p>
<table width="65%" border="0" cellpadding="0" cellspacing="0">
  <tr> 
    <td bgcolor="d5e8f9" class="mnuheader"><strong><font size="5">my account</font></strong></td>
  <tr> 
    <td bgcolor="e5ecf9" ><form name="form1" style="padding:5px;">
    	<p>My Account</p>
        <p align="left"> 
		<a href="keyinput.php" style="text-decoration:none">
		<button height="25px" width="130px">Keys</button></a>
          </p>
        </p>
        <p>&nbsp;</p>
<p>Logged as <?php echo $_SESSION['user_name']; ?> | <a href="settings.php">Settings</a> 
  | <a href="logout.php">Logout</a> </p>
<?php } ?>

<?php
session_start();

include ('dbc.php'); 

		$keys = rand(1000,9999);
		mysql_query("INSERT INTO users (`key`) VALUES('$keys') WHERE id = $_SESSION['user_name']") or die(mysql_error());
  die ("hello");

?>

<p>&nbsp;</p>
<table width="65%" border="0" cellpadding="0" cellspacing="0">
  <tr> 
    <td bgcolor="d5e8f9" class="mnuheader"><strong><font size="5">key</font></strong></td>
  <tr> 
    <td bgcolor="e5ecf9" ><form name="form1" style="padding:5px;">
	   <p><br>
    	Time issued:
  		<input name="time" type="text" id="time">
    	</p>
    	<p>
    	Please enter your key:
  		<input name="key" type="text" id="key">

ive just started on my keyinput.php and require a little help. i would like to insert data($key) into mysql database(`key`) when the id_in_database is = to the _session id(user_name) from the previous page myaccount.php.
however, i cant seem to bring forward the value. Do i have to retrieve it all over again?. What am i doing wrong?.
Also, i would like my page to display the time when my key is inserted into the database, to the a box named time issued:, any tips on how to do so?.

Any help would be greatly appreciated.
Been working on it for the past 5 hours and im stuck =x
Thanks,
Danny

pritaeas 2,194 ¯\_(ツ)_/¯ Moderator Featured Poster · Answer 5 · 2009-07-27T14:25:30+00:00

replace session_start(); with:

if (! session_id())
    session_start();

Calling session_start() may overwrite your existing session.

php login help

Recommended Answers Collapse Answers

All 7 Replies

Recommended Answers