php help wanted - please

[Smifffy]

ive run into a bump

this is the code for the a login page

<?php
$PageTitle = "Login Page";
if ($Message == "Invalid") {
print ("<B><CENTER><FONT COLOR=RED>The username and password you entered do not match what is on file. Please try again!</FONT></CENTER></B>\n");
}
?>
<FORM ACTION="HandleLogin.php" METHOD="POST">
Username: <INPUT TYPE="TEXT" NAME="UserName"><BR>
Password: <INPUT TYPE="PASSWORD" NAME="Password"><BR>
<INPUT TYPE="SUBMIT" NAME="SUBMIT" VALUE="Submit!">

that gets sent to handlelogin.php

<?
// database configuration

$host = "localhost";
$user = "root";
$pass = "";
$db = "test";

// open database connection
$connection = mysql_connect($host, $user, $pass) or die ("Unable to connect!");

// select database
mysql_select_db($db) or die ("Unable to select database!");

// generate and execute query
$query = "SELECT name, password, level FROM login WHERE name = '$username'";
$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());

//checks validity
if (($UserName == "$row->name") && ($Password == "$row->password")) {

// if valid
echo "well done";}

// if not valid or username does not exist then display message
else
{
echo "oops";}

// close database connection
mysql_close($connection);
?>

the DB is not the problem but it seems to only show the not valid message even when i enter the correct user/pass

any help would be apprecated

[mrmufin]

Plenty of extra stuff in there, without doing the right things to the right stuff:

// generate and execute query
$query = "SELECT level FROM login WHERE name = '$username' AND password='$password'";
$result = mysql_query($query) or die ("Error in query: $query. " . mysql_error());
if(mysql_num_rows($result) > 0) {
	// then I guess the username and password was correct, eh?
	// Now get the 'level':
	$row = mysql_fetch_row($result);
	$level = $row[0];
} else {
	// the username and or password was wrong
}

Any better?

[Smifffy]

ill try that
im fairly new to the codeing bit

thanks