editing existing code - double database check

[msi3753]

okay, this is a little complex, so bare with me (also, can reward people with webspace/shell for any really generous responces 🙂). first, here is the existing code...

function loginaction($username, $password) {
  global $uid;
  dbconnect();
  $query = "SELECT * FROM IPM_users WHERE username='$username'";
  if (!($result = mysql_query($query))) {
  	die("Couldn't retrieve authorization data, please try again later");
  }
  if (mysql_num_rows($result) > 0) {
  	if ($user=mysql_fetch_array($result)) {
  	  if (md5($password) == $user[password]) {
        ($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
        setcookie("uid", $user[id], "0", "", "", $SSL);
        $uid = $user[id];
        mytasks();
      } else {
        login();
      }
    }
  } else {
    login();
  }
}

what i want to do is use username/password from another database (seen below)

dbconnect2();
$query = "select username, password, password('$pass') from $table where username = '$user'";
$result = mysql_db_query($db, $query, $connection) or die ("error in query: $query");
$dbrow = mysql_fetch_array($result, MYSQL_NUM);
$pass = $dbrow[1];
$pass2 = $dbrow[2];
if ($pass == $pass2)

if that user/password check out, i want to check and see if user exist in the project database (dbconnect), if so, log the person is. if not create the user (note i do NOT want to dump the password. for safety reasons that should stay in dbconnect2, so i used NULL to fill in the password space), then login. the code i came up with this is below.

(mysql_num_rows($result) < 0) {
$query="INSERT INTO IPM_users VALUES (NULL,'$username','NULL','$username','$domain','$username@$domain','1')";
mysql_query($query);
if (md5($password) == $user[password]) {
($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
setcookie("uid", $user[id], "0", "", "", $SSL);
$uid = $user[id];
mytask();
}

i am not sure if this code is correct, but i'm giving it as a reference. thank you for reading, php for life! also, i blame my cold in the reason i can't figure this out, although the real reason is i probably left out a few } 🙂

[diego25]

i am not sure if this code is correct

So what happened after you tested your code? Is there an error message or what?

Diego

[msi3753]

well, here is the code i used for the login function

function loginaction($username, $password) {
global $uid;
dbconnect2();
$query = "select username, password, password('$pass') from $table where username = '$user'";
$result = mysql_db_query($db, $query, $connection) or die ("error in query: $query");
$dbrow = mysql_fetch_array($result, MYSQL_NUM);
$pass = $dbrow[1];
$pass2 = $dbrow[2];
if ($pass == $pass2) {

dbconnect();
$query="SELECT id FROM IPM_users WHERE username='$username'";
$result=mysql_query($query);
if (mysql_num_rows($result) > 0) {
if ($user=mysql_fetch_array($result)) {
if (md5($password) == $user[password]) {
($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
setcookie("uid", $user[id], "0", "", "", $SSL);
$uid = $user[id];
mytasks();

} elseif { (mysql_num_rows($result) < 0) {
$query="INSERT INTO IPM_users VALUES (NULL,'$username','NULL','$username','mg2','$[e-mail]','1')";
mysql_query($query);
if (md5($password) == $user[password]) {
($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
setcookie("uid", $user[id], "0", "", "", $SSL);
$uid = $user[id];
mytask();

} else {
login();
}
}

and the responce was

Parse error: parse error, expecting `'('' in /html/functions.php on line 2644

Fatal error: Call to undefined function: isauthenticated() in /html/index.php on line 34

line 2644 is the first mytask(); function
the isauthenticated() code is as follows

function isauthenticated() {
    global $uid;
    return !empty($uid);
}

and line 34 of index.php is the first line of this

if ($op != "loginaction" && !isauthenticated()) {
  login();
  return;
}

PLEASE HELP! I have included all of the files in a zip attachment to this msg (except for the files containing mysql info, but they are valid).

[dopey]

There's an extra { that shouldn't be there on line 2644:

} elseif { (mysql_num_rows($result) < 0) {

should be

} elseif (mysql_num_rows($result) < 0) {

Also, there were many missing closing brackets in the loginaction() function. Should look something like this:

function loginaction($username, $password) {
        global $uid;
        dbconnect2();
        $query = "select username, password, password('$pass') from $table where username = '$user'";
        $result = mysql_db_query($db, $query, $connection) or die ("error in query: $query");
        $dbrow = mysql_fetch_array($result, MYSQL_NUM);
        $pass = $dbrow[1];
        $pass2 = $dbrow[2];

    if ($pass == $pass2) {

        dbconnect();
        $query="SELECT id FROM IPM_users WHERE username='$username'";
        $result=mysql_query($query);

        if (mysql_num_rows($result) > 0) {
            if ($user=mysql_fetch_array($result)) {
                if (md5($password) == $user[password]) {
                    ($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
                    setcookie("uid", $user[id], "0", "", "", $SSL);
                    $uid = $user[id];
                    mytasks();

                } elseif (mysql_num_rows($result) < 0) {
                    $query="INSERT INTO IPM_users VALUES (NULL,'$username','NULL','$username','mg2','$[e-mail]
g','1')";
                        mysql_query($query);

                    if (md5($password) == $user[password]) {
                        ($SECURE_COOKIES == "true")? $SSL=1: $SSL=0;
                        setcookie("uid", $user[id], "0", "", "", $SSL);
                        $uid = $user[id];
                        mytask();

                    } else {
                        login();
                    }
                }
            }
        }
    }
}

that stops the parse errors... good luck! 🙂

Cheers

[msi3753]

thanks =), this helped a lot, now i get this message when i try to login

Warning: mysql_db_query(): supplied argument is not a valid MySQL-Link resource in html/functions.php on line 2629
error in query: select username, password, password('') from where username = ''

i need to mess around with the syntax, i think this code should work