Member Avatar for PinoyDev

I want this javascript to directly compare the username and password of the user who login to mysql table that holds all the registered username and password..

<script type="text/javascript">

$("#login_form").bind("submit", function() {

	if ($("#login_name").val().length < 1 || $("#login_pass").val().length < 1) {
	    $("#login_error").show();
	    $.fancybox.resize();
	    return false;
	}

	$.fancybox.showActivity();

	$.ajax({
		type		: "POST",
		cache		: false,
		url		: "members_accnt.php",
		data		: $(this).serializeArray(),
		success		: function(data) {
				$.fancybox(data);
		}
	});

	return false;
});

 </script>

Thank you for helping!

Edited by PinoyDev because: n/a
  • 4 Contributors
  • 5 Replies
  • 117 Views
  • 23 Hours Discussion Span
  • Latest Post Latest Post by PinoyDev

Dani AI

Generated

Short answer: a browser-side script cannot and should not talk directly to MySQL. The client (JavaScript) must POST credentials to a server endpoint (AJAX), and the server must do the database check and return only a minimal success/failure response. That is the approach was pointing to; the quick "echo PHP into JS" trick that tried will expose sensitive data and is not a secure fix.

Server-side checklist (authoritative practices)

  • Never store plain text passwords. Use a one-way hash and verify with the appropriate function on login.
  • Use parameterized queries (prepared statements) rather than manual escaping to prevent SQL injection.
  • Create a server-side session on successful auth, set a secure, HttpOnly cookie, and return only a small JSON token/flag to the client.
  • Do not send SQL errors, password hashes, or database fields to the browser.

Client-side checklist

  • Send credentials over HTTPS with AJAX and expect a JSON response like { "success": true }.
  • Handle only the UI state in JS (show messages, redirect on success). Do not attempt any comparison of credentials in the browser.
  • Implement basic client validation (non-empty fields) only to improve UX — real validation must be server-side.

Notes tied to the thread

  • 's point about sanitizing input is well-intentioned; prefer prepared statements instead of hand-escaping.
  • The "put quotes around PHP output so JS can read it" approach mentioned later is insecure: anything echoed into the page can be seen or altered by the client and should never carry secrets.

Useful references

Recommended Answers

All 5 Replies

Member Avatar for Member #46692

You might get a better reply posting this in the javascript/DHTML/ajax forum.

Edited by Member #46692 because: n/a
Member Avatar for PinoyDev

You might get a better reply posting this in the javascript/DHTML/ajax forum.

Ive decided to post here in php forum because i use php to access the mysql table that holds the registered username and password.

here it is..

if (isset($_POST['login_name'])){

$username = @stripslashes($_POST['login_name']);
$password =@stripslashes($_POST['login_pass']);

mysql_select_db($database_nmpc_web_conn, $nmpc_web_conn);
$query_rec_mem_accnt = sprintf("SELECT user_name, password, member_id FROM tbl_members_list WHERE user_name = %s and password = %s", GetSQLValueString($username, "text"),GetSQLValueString($password, "text"));

$rec_mem_accnt = mysql_query($query_rec_mem_accnt, $nmpc_web_conn) or die(mysql_error());
$row_rec_mem_accnt = mysql_fetch_assoc($rec_mem_accnt);
$totalRows_rec_mem_accnt = mysql_num_rows($rec_mem_accnt);

Now, is it possible to compare this query in javascript above?

Thank you!

Member Avatar for Member #120589

My take:

if (isset($_POST['login_name']) && isset($_POST['login_pass'])){
 
	$u = mysql_real_escape_string($_POST['login_name']);
	$p = mysql_real_escape_string($_POST['login_pass']);
	 
	mysql_select_db($database_nmpc_web_conn, $nmpc_web_conn); //?from where??
	
	$r = mysql_query("SELECT user_name, password, member_id FROM tbl_members_list WHERE user_name = '$u' and password = '$p'") or die(mysql_error());
	$t = mysql_num_rows($r);
	if($t > 0){
		$d = mysql_fetch_assoc($r);
	}else{
		...
	}
	...
}

BTW - why sprintf? I know what it does/how it works, but what advantage does it give you? Just curious.

Member Avatar for almostbob

Ive decided to post here in php forum because i use php to access the mysql table that holds the registered username and password.

Ajax is how most, allow javascript, clientside, to interact with php, on the server, where JavaScript does not operate with much efficacy.
so why not,
given that you have not written a new language construct to release to the world,
repost the question in the language forum devoted to allowing Javascript to interact with php/sql

2 bricks

Edited by almostbob because: n/a
Member Avatar for PinoyDev

Ive got the solution..just put this ' before and after php tag...it seems that javascript reads the value as a variable!This is good if security issue is not the concern.

Thanks also to ardav for a nice take..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.