simple database / form question

wilzy1

Hi there,

Just trying to connect successfully connect to my DB and create a "Logged in" scenario. Can anyone see a fault in my code?

Can any1 see what's wrong?

I have a db already set up with the username michael and the password michael.

Im testing line by line through the DB results for a correct username / password. Is this the best way to go about it?

Thanks heaps in advance!!!
- Michael

<?

$dblink = mysql_connect ("localhost", "db_username", "db_password")
or die ('I cannot connect to the database.');

if(mysql_select_db ("db_name", $dblink))
{
  $dbStatus = "GOOD";
}
else
{
  $dbStatus = "BAD";
} 
$localun = $_POST['$username'];
$localpw = $_POST['$password'];

// Query DB
$Query = "SELECT * FROM users";
$dbResult = mysql_query($Query, $dblink);


// Test for correct Username / password
$correctUnPw = false;

$i = 0;

while(($row = mysql_fetch_row($dbResult)) && ($correctUnPw == false))
{

$dbUn = "$row[$i]";
$dbPw = "$row[$i]";

//print("$dbUn, $row[5] <br>");


if(($dbUn == $localun) && ($dbPw == $localpw))
{
    $correctUnPw = true;
    $_SESSION['username'] = $dbUn;
}
else
{
    $correctUnPw = false;
	$i++;
}
}

// Print appropriate header based on un/pw.
if($correctUnPw == true)
{
    print("<head>");
	print("<title>Wilzy - Document Management System</title>");
	print("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">");
	print("</head>");
}
else
{
    print("<head>");
	print("<title>Wilzy - Document Management System</title>");
	print("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">");
	print("<META HTTP-EQUIV=Refresh CONTENT=\"0; URL=index.php\">");
	print("</head>");
}


?>

g00bster

I would do something more along the lines of:

$result = mysql_query("select * from users where username = 'localusername' and password = 'localuserpassword'");
if(mysql_num_rows($result) != 1)
{ //print out redirect code }
else
{ //print information requiring login }

you are going about it in a more complicated way by cycling through all the records in the database. this is more direct. think if you had 1,000,000 users in your database. it is much faster to see if one unique record is returned with the supplied username and password (meaning correct combination and should therefore be logged in), versus cycling through all 1,000,00 records to see if the correct combination exists. MySQL does this for you with the "where" clause added to the query.