PHP/MySQL Login form

pablodelapena

Ok, Ive tried searching the forum to no avail. Everything returned didnt really help me understand anythign clearly. So im gonna ask directly.

Well, I have a MySQL database called Users, withinh it there is a table called userinfo. The two main fields im interested in are username and password. Ok, understand? brilliant! moving on.

What I want is a script that checks the input username and password from the form against those in the database. Then when it finds an entry checks the password nagainst the username.

The script which I have written looks like this:
Note, this isnt the ACTUAL script as it is at home and i am not, but I think this is what it looks roughly like, excuse any parse errors as i am a newbie!

$dbhost = "localhost";
$dbuser = "root";
$dbpass = "";

//Connect to MySQL server
$db = mysql_connect($dbhost, $dbuser, $dbpass);

//Select the database to use
mysql_select (users);

$query = "SELECT * FROM userinfo";
$result = "mysql_query($query)";

$row = "mysql_fetch_array($result)";

//This is where I get lost!
//Im not sure how to preform the login check!
//I thought about using a while loop??
//Please bear in mind that this may not be corrcetly written here but on the actual script it is.


while ($row = mysql_fetch_array($result)) {
if (($row[username] == $input_username) && ($row[password] == $input_password)) {
echo ("Successful login!");
//Code for transfer insert here


} else {
echo ("Incorrect login details");
}
}

HELP?!?!

siwis

Your username and password check should form part of your login sql.

$result = mysql_query("SELECT * FROM userinfo WHERE username = '" . addslashes($HTTP_POST_VARS['username']) . "' AND password = password('" . addslashes($HTTP_POST_VARS['password']) . "')");

$valid_login = mysql_num_rows($result);
if ($valid_login != "1") {
   echo "LOGON FAIL";
} else {
   echo "LOGON SUCCESS";
};

This is a very simplified example and works on the basis that the password is stored encrypted in the database.

pablodelapena

cheers! that was actually my next question which i forgot to include. Im assuming that the code you typed replaces the while loop??

Ok, encryption. Md5 i thiunk is the easiest? I dont even have the slightest clue as to where to start!?!?1 help? thanks in advanced and i apologise for my newbie characteristcs!!:p

pablodelapena

Ok, heres the actual code with the new bit implemented, this right?!?!)

<?php

//COMFIGURATION START
$database = "auth";
$dbhost = "localhost";
$dbuser = "root";
$dbpass = "";
//CONFIGURATION END

//This function checks to see if there are any MySQL errors or not.
function CheckMySQL()
{
	if (mysql_errno() > 0)
	{
		die("<br> MySQL error ".mysql_errno().": ".mysql_error());
	}
}


//Lets conect to MySQL so that we can use this script
$db = mysql_connect($dbhost, $dbuser, $dbpass);
if (!$db)
{
	die("Failed to open connection to MySQL server.");
}

//Now lets selct which databse we are going to use.
mysql_select_db("mountaincanon");
CheckMySQL();


$result = mysql_query("SELECT * FROM userinfo WHERE username = '" . addslashes($HTTP_POST_VARS['username']) . "' AND password = password('" . addslashes($HTTP_POST_VARS['password']) . "')");

$valid_login = mysql_num_rows($result);
if ($valid_login != "1") {
   echo "LOGON FAIL";
} else {
   echo "LOGON SUCCESS";
};


?>

yet it returns this error:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in c:\program files\easyphp\www\mysql fiddling\login.php on line 34

😕

pablodelapena

hey sorry, me again, i realised that some of the names were incorrect, like userinfo etc

well, i fixed that and the errors gone. but it always tells em login fail even when i KNOW the password is correct?? Im useless!

siwis

How is the "password" stored in your database????

password() within an sql is a specific function that encrypts the password. If you didn't save it to the db in encrypted form then the passwords won't match, therefore your logon will fail

pablodelapena

well, im new to the all, both the username and password are stored unencrypted (if you can help me encrypt them, much appreciated) as VARCHAR(50) that answer your question??

pablodelapena

me again. Ok, i discoverd md5 is easy.

this is how i register a user.

$userpass = md5($password);

$query_addusertoAuth = "INSERT INTO auth (username, password, email) VALUES ('$username', '$userpass', '$email')";
$result = mysql_query($query_addusertoAuth);
CheckMySQL();


echo ("Record added! You can now login!

good, adds entry all fine and dandy, encrypted password.

Now when i sue the above script to check logn, always a login failed!!!!

siwis

Use VARCHAR (16) for your password field

Then here is the corresponding INSERT:
(There is no need to MD5 the password before entering it. MySQL has its own function).

$insert_sql = "INSERT INTO auth (username, password, email) 
				VALUES ('" . $HTTP_POST_VARS['username'] . "', password('" . addslashes($HTTP_POST_VARS['userpass']) . "'), '" . $HTTP_POST_VARS['email'] . "')";
$create_query = mysql_query("$insert_sql", $db);

pablodelapena

yeay! works nw! dunno what it does or understand it, but it works, im gonna leave it!

Thanks sooo much! cheers!