Please can someone tell me what's wrong with this login script?
<?php
if (isset($_POST['submit'])) {
require_once ('mysql_connect.php');
function escape_data ($data) {
global $dbc;
if (ini_get('magic_quotes_gpc')) {
$data = stripslashes($data);
}
return mysql_real_escape_string($data, $dbc);
}
$message = NULL;
if (empty($_POST['username']))
{
$u = FALSE;
$message .= '<p>You forgot to enter your username!</p>';
}
else {
$u = escape_data($_POST['username']);
}
if (empty($POST['password'])) {
$p = FALSE;
$message .= '<p>You forgot to enter your password!</p>';
} else {
$p = escape_data($POST['password']);
}
if ($u && $p) { // If everything's OK.
$query = "SELECT user_id, first_name FROM users WHERE username='$u' AND password=PASSWORD('$p')";
$result = @ ($query);
$row = mysql_fetch_array ($result, MYSQL_NUM);
if ($row) {
// Start the session, register the values & redirect.
session_name ('YourVisitID');
ini_set ('session.use_cookies', 0);
session_start();
$SESSION['first_name'] = $row[1];
$SESSION['user_id'] = $row[0];
header ("Location: [url]http://[/url]" . $SERVER['HTTP_HOST'] . dirname($SERVER['PHP_SELF']) . "/loggedin.php?" . SID);
exit();
} else {
$message = '<p>The username and password entered were not recognised.</p>';
}
mysql_close();
} else {
$message .= '<p>Please try again.</p>';
}
}
$page_title = 'Login';
if (isset($message)) {
echo '<font color="red">', $message, '</font>';
}
?>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<fieldset><legend><font color="000000">Enter your information in the form below:</font></legend>
<p><b>User Name:</b>
<input type="text" name="username" size="10" maxlength="20" value="<?php if (isset($POST['username'])) echo $POST['username']; ?>" /></p>
<p><b>Password:</b> <input type="password" name="password" size="20" maxlength="20" /></p>
<div align="center"><input type="submit" name="submit" value="Login" /></div>
</form>
There's nothing wrong with the mysql_connect file because I have gotten it to work on this script :
<?php
$page_title = 'HP';
include ('templates/header.inc');
require_once ('mysql_connect.php');
$id = 1;
$sql = 'SELECT HP,G FROM users WHERE user_id = '.$id;
$res = mysql_query($sql) or die("Query Error: ".mysql_error());
$data = mysql_fetch_array($res) or die("Fetch Error: ".mysql_error());
$hp = $data[HP];
$heal = 20;
$cost = 50;
if($data['G'] < 50)
{
echo 'You have insufficient Gold to do this.';
exit;
}
$query = "UPDATE users SET HP = HP+$heal, G = G-$cost WHERE user_id = $id";
$result_up = mysql_query( $query ) or die( mysql_error() );
echo 'HP increased by 20 - At the cost of 50Gold';
mysql_close();
?>
Please can someone tell me what my difference is between those two and why it wont work? :S does the login have errors in it?
