Login

shaun680

Been playing around with php for a couple of days, and wrote this:

<html>
<head>
<title>Login</title>
</head>

<body>

<?php

if ($submit) {
	$db = mysql_connect("localhost", "root");
	mysql_select_db("users", $db);
		if ($result = mysql_query("SELECT username, password FROM users WHERE username = '$username'", $db)) {
			$row = mysql_fetch_array($result);
				if( ($password) == $row['password']) {
					echo "login successful";
				} else {
					echo "wrong password";
				}
		} else {
			echo "No such user in db";
		}
} else {
	?>
	<form method="post" action="<?php echo $PHP_SELF ?>">
	Username:<input type="Text" name="username"><br>
	Password:<input type="Password" name="password"><br>
	<input type="Submit" name="submit" value="Login">
	</form>
	<?php
}
?>
</body>
</html>

It works if you type a username thats in the database. If you have a username thats not in the database, leave the password field blank and it logs in, if you put a password then the "wrong password" bit comes up (instead of skipping to the "no such user" bit.)

Bear in mind I have register globals on, so thats not the problem.

jpmoriarty

i guess the problem is that it's not finding any rows with that user name, so when you look at the password field for that user name it's blank (and so matches what they didnt enter).

Cant you just include a

if (@!$password)
{
  echo "Please enter a password";
}
else if ($result = mysql_query("SELECT username, password FROM users WHERE username = '$username'", $db))
{
      $row = mysql_fetch_array($result);
      if( ($password) == $row['password'])
      {
          echo "login successful";
      }
      else
      {
          echo "wrong password";
      }
}
else
{
      echo "No such user in db";
}

dotbands

if (@!$password)
{
  echo "Please enter a password";
} else {
if ($result = mysql_query("SELECT username, password FROM users WHERE username = '$username' AND password = '$password'", $db))
{
      $row = mysql_fetch_array($result);
      $totalrows_result = mysql_num_rows($result);

  if( $totalrows_result > 0) {

      echo "login successful";
  }
  else
  {
$result = mysql_query("SELECT username, password FROM users WHERE username = '$username' ",$db)
$row = mysql_fetch_array($result);
      $totalrows_result = mysql_num_rows($result);

  if( $totalrows_result > 0) {
      echo "wrong password";
  } else {
  echo "No such user in db";
}

that should do it

shaun680

Cheers