Need help with login script

n00854180t

Hi, I just need help with comparing a form variable to a variable in a database and displaying the information for that user if the username and password is correct.

This is what I have so far...I just need an example of how to compare and match the variables, then display relavent data.

It doesn't have to be all in this one script either. Thanks in advance.

<?php

$sql = "SELECT * FROM characters";
$dbaddress = "localhost";
$dbuser = "user";
$dbpass = "pass";
$dbname = "db";

$db = mysql_connect($dbaddress, $dbuser, $dbpass) or die("Could not connect: " . mysql_error());
	mysql_select_db($dbname,$db);
		$result = mysql_query($sql, $db);

if ($submit) {

  // process form


printf("Character Name: %s<br>\n", mysql_result($result,0, "cName"));
printf("Empire: %s<br>\n", mysql_result($result,0, "cEmpire"));
printf("Rank: %s<br>\n", mysql_result($result,0, "cRank"));
printf("Outfit: %s<br>\n", mysql_result($result,0, "cOutfit"));




} else { 

mysql_close($db);

?>


<form method="post" action="<?php echo $PHP_SELF ?>">
<input type="text" name="txtUser">
<input type="text" name="txtPass">
<input type="Submit" name="submit">
</form>

<?php



}

?>

Xoid

something like this:

$sql = "SELECT * FROM characters WHERE username=$_POST['txtUser'] AND password=$_POST['txtPass'];";

n00854180t

Okay, I had looked into something like that before, but how do I display the data only if those conditions are true?

n00854180t

If I use that type of SQL query it still doesn't work...It will let you view the data regardless of what you enter in the form.

leatherback

You have your query as placed above.

Then:

$result = mysql_query($sql);

$rows = mysql_num_rows($result)
if ($rows>0)
{
//show results
}
else
{
//show login form again
}

n00854180t

How can I make it so it only displays the data of the username entered? How it is it will display the data from all members.

n00854180t

I really appreciate all the help btw.

leatherback

It should now only give the results beloning to the person who logged in.. See Xoid:

SELECT * FROM characters WHERE username=$_POST['txtUser'] AND password=$_POST['txtPass'];";

n00854180t

I get this error if I don't take out "$_POST" and the [] brackets.

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /<path>/login.php on line 4

leatherback

Hi,

I am not sure, but I think the error is caused by:
['txtPass'];";

This should be:
['txtPass']";

You DO need the $_POST though, since the 'normal' variables are empty, which would give you a useless database query!

n00854180t

I'm still getting that same error. Here is the code as I have it right now.

<?php

$sql = "SELECT * FROM characters WHERE cName=$_POST['txtUser'] AND cPass=$_POST['txtPass']";

$datasql = "SELECT * FROM characters";

$dbaddress = "localhost";
$dbuser = "user";
$dbpass = "pass";
$dbname = "db";

$db = mysql_connect($dbaddress, $dbuser, $dbpass) or die("Could not connect: " . mysql_error());
	mysql_select_db($dbname,$db);
		$result = mysql_query($sql, $db);
		$dataresult = mysql_query($datasql, $db);
		$rows = mysql_num_rows($result);


if ($submit && $rows>0 && $myrow = mysql_fetch_array($dataresult)) {

  echo "<tr><td>Character Name</td><td>Empire</td><td>Rank</td><td>Outfit</td></tr>\n";

  do {



printf("<tr><td>%s</td><td>%s</td><td>%s</td><td>%s</td></tr>\n", $myrow["cName"], $myrow["cRank"], $myrow["cEmpire"], $myrow["cOutfit"]);

  } while ($myrow = mysql_fetch_array($dataresult));

echo "</table>\n";

} else {

echo "Sorry, no records were found!";	


mysql_close($db);

?>


<form method="post" action="<?php echo $PHP_SELF ?>">
<input type="text" name="txtUser">
<input type="text" name="txtPass">
<input type="Submit" name="submit">
</form>

<?php

}

?>

n00854180t

Okay I fixed that error (it was because of the single quotes). But I am getting another error:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home3/apoji/public_html/login.php on line 17

stolzyboy

likely cuz this

$rows = mysql_num_rows($result);

needs to be

$rows = mysql_num_rows($dataresult);

n00854180t

If I make
mysql_num_rows($result); into
mysql_num_rows($dataresult);

It gives me all members data.

I made the second sql query ($datasql and $dataresult) because it was giving me the same error when I tried to grab the data with the $sql query.

stolzyboy

well then usually this error is cuz the query isn't returning any results

use this and it will tell you what is wrong with the query

$rows = mysql_num_rows($result) or die(mysql_error());

n00854180t

It's not even parsing to the "or die()". It's just giving me the same error.

n00854180t

mysql_error(); reports that I have an error in SQL syntax by "cPass="

This is my current code:

<?php

$sql = "SELECT * FROM characters WHERE cName=$_POST[txtUser] AND cPass=$_POST[txtPass]";

$datasql = "SELECT * FROM characters";

$dbaddress = "localhost";
$dbuser = "user";
$dbpass = "pass";
$dbname = "db";

$db = mysql_connect($dbaddress, $dbuser, $dbpass) or die("Could not connect: " . mysql_error());
	mysql_select_db($dbname,$db);
		$result = mysql_query($sql, $db) or die(mysql_error());
		$dataresult = mysql_query($datasql, $db);
		$rows = mysql_num_rows($result) or die(mysql_error());


if ($submit && $rows>0 && $myrow = mysql_fetch_array($dataresult)) {

  echo "<tr><td>Character Name</td><td>Empire</td><td>Rank</td><td>Outfit</td></tr>\n";

  do {



printf("<tr><td>%s</td><td>%s</td><td>%s</td><td>%s</td></tr>\n", $myrow["cName"], $myrow["cRank"], $myrow["cEmpire"], $myrow["cOutfit"]);

  } while ($myrow = mysql_fetch_array($dataresult));

echo "</table>\n";

} else {

echo "Sorry, no records were found!";	


mysql_close($db);


?>

<form method="post" action="<?php echo $PHP_SELF ?>">
<input type="text" name="txtUser">
<input type="text" name="txtPass">
<input type="Submit" name="submit">
</form>

<?php

}

?>

stolzyboy

do this, put

<?
$txtUser = $_POST['txtUser'];
$txtUser = $_POST['txtPass'];
?>

before your $sql, then replace your $sql with the one below

<?
$sql = "SELECT * FROM characters WHERE cName='$txtUser' AND cPass='$txtPass';";
?>

n00854180t

Thanks for all the help you guys!