Form Authentication

[Anon]

Hello All:

Trying to take the following auth code and have the ability to grab other fields from the table the username and password are grabbed from. The reason is I need to have records associated with the user login rather than showing all of them. any ideas or help is greatly appreciated.

Thanks

<? session_start();?>
<?
if(!isset($username)&&!isset($password))
{
//Visitor needs to enter a name and password
?>
<h1>Please Log In</h1>
This page is secret.
<form method = post action = "index.php">
<table border = 1>
<tr>
<th> Username </th>
<td> <input type="text" name="username"> </td>
</tr>
<tr>
<th> Password </th>
<td> <input type="password" name="password"> </td>
</tr>
<tr>
<td colspan =2 align = center>
<input type = submit value = "Log In">
</td>
</tr>
</form>
<?
}
else
{
// connect to mysql
$mysql = mysql_connect( 'localhost', 'email', 'boysee' );
if(!$mysql)
{
echo 'Cannot connect to database.';
exit;
}
// select the appropriate database
$mysql = mysql_select_db( 'emailontime_com' );
if(!$mysql)
{
echo 'Cannot select database.';
exit;
}

// query the database to see if there is a record which matches
$query = "select count(*) from agent where
          username = '$username' and
          password = '$password'";

$result = mysql_query( $query );
if(!$result)
{
  echo 'Cannot run query.';
  exit;
}

$count = mysql_result( $result, 0, 0 );

if ( $count > 0 )
{
  // visitor's name and password combination are correct
  echo "<h1>Here it is!</h1>";
  echo "Welcome $username view records here";
}
else
{
  // visitor's name and password combination are not correct
  echo "<h1>Go Away!</h1>";
  echo "You are not authorized to view this resource.";
}

}
?>

[Anon]

What you are doing is counting the number of times the username and password match. You aren't actually pulling any records from the table.

You may want to do a query like this ...

$query_result = mysql_query("select * from agent where username='$username' && password='$password'");

Then do a mysql_fetch_row to extract the actual data ...

$data = mysql_fetch_row($query_result);

If your table has, say three fields (username, password, age), you would reference the results like this ...
$data[0] -> is the username
$data[1] -> is the password
$data[2] -> is the age

HTH