Simple Authentication Problems

Brad

This is a simple user authentication script to access a bulletin board, why is this rejecting a partially filled out form but allowing not only the usernames and passwords in the database to enter but anything you type in the boxes?! I don't see how a completed for not in the database can be used to gain access when the permission is given on the $num_results from the table being either 1 or 0. If the $num_results variable is 0 (no rows matching the info) how are they still getting access. Anyway, Here is the basis of the code.

$sql = "SELECT * FROM RegUsers
WHERE Name='$use' AND Password='$pass'";
$result = mysql_query($sql) or die(mysql_error());
$num_results = mysql_num_rows($result);
if ($num_results = 0)
{
echo "<font face='verdana' color='#FFFFFF' size='2'>Invalid username or password, <a href='index.php'>try again</a>!";
return false;
}
if ($num_results = 1)
{
echo "<font face='verdana' color='#FFFFFF' size='2'><a href='bulletin.php'>Click here</a> to continue.";return true;
}
Any help on this would be great, I'm kinda new at this and have done this from scratch.

hkucsis

use == for comparsion

if ($num_results == 0)

Brad

Cool, thanks for the help!

Brad

This is still not working! I have added echo tags to view the value of the $result variable and $num_results variables and am getting a Resource id #2 value for the $result variable and a constant 0 for the $num_results variable. What does the Resource id #2 thing mean?!? I'm not sure what the problem is. Can anyone help? Here is my code.

$sql = "SELECT Name, Password FROM RegUsers WHERE Name='$use' AND Password='$pass'";
$result = mysql_query($sql) or die(mysql_error());

				//testing the result variable for value which ends up being resource id #2
				echo "$result<br><br>";

				$num_results = mysql_num_rows($result);

				//checking the num_results for value which is constantly 0
				echo "$num_results";

				if ($num_results == 1)
				{
				echo "<font face='verdana' color='#FFFFFF' size='2'><a href='bulletin.php'>Click here</a> to continue.";
				return false;
				}

				if ($num_results == 0)
				{
				echo "<font face='verdana' color='#FFFFFF' size='2'>Invalid username or password, <a href='index.php'>try again</a>!";
				return false;
				}

nightowl

try echoing the SQL and see what it says ? Try running it on your db instead of via PHP. does it return results ? probably not ?

Brad

Nightowl,

I tried that and got a resource id #2 message for the $result variable and so the $num_rows variable is always 0. Do you know what Resource Id #2 means? This would help to figure out where things are going wrong.

crosbystillsnas

echo $result...? what for?

SELECT in a query returns a pointer to the location in memory where the result list is stored. if you want to output the values of the query go ahead with something like:

$i;
while($list = mysql_fetch_row($result)){
$sqlValues[$i] = $list;
$i++;
}
..you then have the array $sqlValues that contains:
$sqlValues[0][0] = Name Row 0
$sqlValues[0][1] = Password Row 0

anyway the >>$num_results = $mysql_num_rows($result)<< should work, so there query does not have any effect.
i would just suggest the point here:

WHERE Name='$use' AND Password='$pass'<<
is it really $use or maybe $user?
try echoing the query and have a look at it:
echo $sql;

martyn

$i;
while($list = mysql_fetch_row($result)){
$sqlValues[$i] = $list[rowheader];
$i++;
}

$list is an array

crosbystillsnas

i think its $sqlValues[$i] = $list[rowheader] when using mysl_fetch_array($result). $sqlValues[$i] = $list works correctly after mysql_fetch_row($result).....

martyn

darn posting before caffine is bad 🙁

kevinsequeira

do this :

echo $sql;

see what is spits out and try to run it directly in your db to see if you are getting any results.

it might be that the query is not formed properly.

if your posting from a form u might need to have these 2 line before the $sql

$use = $POST['use'];
$pass = $POST['pass'];
$sql = "SELECT Name, Password FROM RegUsers WHERE Name='$use' AND Password='$pass'";

in the form are the input variables called use and pass ??

reg
kevin

ofSHIZ

I think you might have not run the query against the databse
Your Code

$result = mysql_query($sql) or die(mysql_error());

A new Code

$result = mysql_query("$sql", "$db") or die(mysql_error());

The $db would be your database connection and stuff..
Hope this helps..