Crying for Log IN

thebay

Warning: mysql_close(): supplied argument is not a valid MySQL-Link resource in D:\users\imagiq\login\check.php on line 40, i.e.

mysql_close($conn);

1) Above error came with running the following code for log in, what the run with this?

2) why it always saying invalid log in? (due to MD5 --function)?)

<?php
session_start();
$sessid=session_id();

if ($_session['userid'])
{
header("Location: http://www.dot.com/main.php");
}

if ($POST['submit'] && $POST['user'] && $_POST['passwd']) {

echo $POST['user'];
echo $POST['passwd'];

$conn=mysql_connect("localhost","root","");

mysql_select_db("imagiq",$conn);

//$test = mysql_result(mysql_query("SELECT COUNT() FROM users WHERE user='".$POST['user']."' AND passwd=MD5('".$POST['passwd']."')"),0);
$sql = "SELECT COUNT() FROM users WHERE user='".$POST['user']."' AND passwd=MD5('".$POST['passwd']."')";
$rs = mysql_query($sql);
$test = mysql_result($rs,0);

}

if ($test == 1) {
$userid= mysql_result(mysql_query("SELECT id FROM users WHERE user='".$POST['user']."' AND passwd=MD5('".$POST['passwd']."')"),0);

$_SESSION['userid'] = $userid;
header( "http://www.dot.com/main.php");

}
else
{

mysql_close($conn);
session_destroy();

echo '<html>
<head>
<title>Login failed!</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" text="#000000" link="#000000" vlink="#000000" alink="#000000" background="../images/bg5.gif">

Invalid login. Please try again <a href="login.php">here</a>
</body>
</html>';

}
?>

Spudgun

MD5 is not a valid SQL function.
You need to convert the password using the MD5 function within PHP before placing it in your SQL statement.

so, for example:

$password = MD5('".$_POST['passwd']."');
$sql = "SELECT COUNT(*) FROM users WHERE user='".$_POST['user']."' AND passwd=$password";

HTH

Weedpacket

Spudgun: MySQL has an MD5() function.

thebay: you'll get that error when any of your $POST['submit'], $POST['user'] or $_POST['passwd'] variables are empty and $test is not 1. When that happens, you never open the database connection - but later on you try to close it.

if ($_session['userid'])
{	header("Location: http blah");
}
if ($_POST['submit'] && $_POST['user'] && $_POST['passwd'])
{	$conn=mysql_connect("localhost","root",""); 
	...(block 1)
}

if ($test == 1)
{	...(block 2)
}
else
{	mysql_close($conn);
	...(block 3)
}

You probably don't need to close the database connection, but if you do, then the place to do it would be at the end of block 1. If you want to use the database connection later, you'll need to open the database connection before you start checking those $_POST[] variables.