Please help!!

[Anon]

Hey!

Im working on a project that involves a login... the code that handles the login is shown below...

<?php
include '/usr/home/s/l/slackernet/public_html/include/functions.inc.php';
include '/usr/home/s/l/slackernet/public_html/include/db_connect.inc.php';
session_start();

if(!isset($username) && ($password)) {
output_header("Authentication Error");
echo "<CENTER><DIV CLASS=\"pagetitle\">Authentication Error</DIV></CENTER>";
echo "<DIV CLASS=\"maintext\">Please go back and provide both a username and password.</DIV>";
output_footer();
exit;
}

$result = mysql_query("SELECT ID, username FROM slacker_users WHERE username = '$username' AND password = '$password';");
if(!mysql_num_rows($result)) {
output_header("Authentication Error");
echo "<CENTER><DIV CLASS=\"pagetitle\">Authentication Error</DIV></CENTER>";
echo "<DIV CLASS=\"maintext\">Invalid username and password combination. Please go back and try again.</DIV>";
output_footer();
} else {
$r = mysql_fetch_array($result);

session_register("ID");
session_register("User");
$ID = $r[ID];
$User = $r[username];

echo "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=\"$redir\">";

}

?>

Right.. Iv'e been at this for 3 days and I can't understand why this is happening. When I login, I am using a valid username and password. But, im getting an error message and the session is registering. I don't understand it.

For a working example of what I mean goto:

http://www.slackernet.org/messenger/index.php
you will be asked to login use the following details..

User: Stezz
Pass: asopkjqw

Please can someone tell me why this is happening! Iv'e made many login systems this way before and I have never had any trouble. It doesn't make sense that im having all this trouble that Iv'e never had before now.

Again, Please help if you can spot what's wrong.

Thanx!

Regards, Stezz.

[rrijnders]

UGH! If I see another one of these I'm going to scream! (kidding)

<font color=blue>
$result = mysql_query("SELECT ID, username FROM slacker_users WHERE username = '$username' AND password = '$password';");
</font>

<font color=red>You can not put SINGLE QUOTES around your variables inside a string assignment.</font>

Single quotes will stop PHP from dereferencing your variables. You must concatenate single quotes AROUND the variable:

<font color=blue>
$result = mysql_query("SELECT ID, username FROM slacker_users WHERE username = '" . $username . "' AND password = '" . $password . "';");
</font>

-- Rich

[Anon]

Yes, you can have single quotes inside of double quoted strings and it will not stop variables from parsing.

If you have a string that is opened/closed with a single quote then you can not have variables in it. I see no problem in his sql query.

[rrijnders]

Hmmm, doesn't work on my box...
I'll test on another version...

[Anon]

Iv'e coded like this since I started PHPing and it's always worked for me.

[rrijnders]

Odd. Variables expand on my PHP4 box but not on my 3.06 box. From the manual:

<font color=blue>Variables will not be expanded inside a single-quoted string. </font>

[rrijnders]

Where exactly is the error occuring? Does the script get to the SQL inquiry?

I had a problem way back when where IE was sending extra spaces back in variables (not NS, though oddly). Try using <b>trim()</b> on the userid and password before putting them in your query.

-- Rich