login/register script!

[helz]

well i tried these login/register scripts here:
Register script here
Login script here

heres the register script that i have atm. except i get a:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /register.php on line 8

<?
require "".$DOCUMENT_ROOT."/cgi-bin/connect.php";
if ($REQUEST_METHOD=="POST") {
$rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username' AND password = '$password' ");
$result = mysql_db_query($db,$rs,$cid);

//if the user exists
if (mysql_num_rows($result)>0) {
  echo("The user already exists, please try again<br><br>".$back."");
} else {
  //the user does not exist set him into the user table
  $sql = mysql_query("INSERT INTO ".$membertable." (username, password) VALUES ( '$username', '$password'  ) ");	
	echo("You have registered!");
}
} else {
echo "Register Form:<br>
        <form action='".$PHP_SELF."' method='post'>
		<table>
		<tr><td>Name</td><td><input type='textfield' name='username'></td></tr>
		<tr><td>Password</td><td><input type='textfield' name='password'></td></tr>
		<tr><td colspan=2><input type='submit' value='Register!'></td></tr>
		</table>
		</form>";
}
?>

even though the error shows, it still adds the user into the database

[drawmack]

<?
require "".$DOCUMENT_ROOT."/cgi-bin/connect.php";
if ($REQUEST_METHOD=="POST") {
  $rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username' AND password = '$password' ");

  //make sure that the query returned something because failed
  //queries return 0 and not a resource
  if ($result = mysql_db_query($db,$rs,$cid)) {
    //if the user exists
    if (mysql_num_rows($result)>0) {
      echo("The user already exists, please try again<br><br>".$back."");
    } else {
      //the user does not exist set him into the user table
      $sql = mysql_query("INSERT INTO ".$membertable." (username, password) VALUES ( '$username', '$password'  ) ");	
      echo("You have registered!");
    } //end if
  } else {
    echo "Register Form:<br>
        <form action='".$PHP_SELF."' method='post'>
		<table>
		<tr><td>Name</td><td><input type='textfield' name='username'></td></tr>
		<tr><td>Password</td><td><input type='textfield' name='password'></td></tr>
		<tr><td colspan=2><input type='submit' value='Register!'></td></tr>
		</table>
		</form>";
  } //end if
//now we error trap the empty set
} else {
   //send out appropriate resonpse
  echo 'user not found in database please try again.'
} //end if
?>

[Hawk2005]

Correct me if i'm wrong, but the problem lies in these two lines:

$rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username' AND password = '$password' "); 
$result = mysql_db_query($db,$rs,$cid); 

I think your doing things twice here. mysql_query would return an error if an database wasn't selected already.
mysql_db_query returns nothing because it looks something like:

mysql_db_query("database","Resource id #2","Resource id #1");

The second arg is not a proper SQL-String, it's a resource id.

I didn't test, but i looked strange to me.

The following would do (i think):

<? 
require "".$DOCUMENT_ROOT."/cgi-bin/connect.php"; 
if ($REQUEST_METHOD=="POST") { 
  // if no db is selected uncomment the following line
  #mysql_select_db($db,$cid);
  $rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username' AND password = '$password' ",$cid); 

  //make sure that the query returned something because failed 
  //queries return 0 and not a resource 
  if ((bool)$rs)) { 
    //if the user exists 
    if (mysql_num_rows($result)>0) { 
      echo("The user already exists, please try again<br><br>".$back.""); 
    } else { 
      //the user does not exist set him into the user table 
      $sql = mysql_query("INSERT INTO ".$membertable." (username, password) VALUES ( '$username', '$password'  ) ");     

      echo("You have registered!"); 
    } //end if 
  } else { 
    echo "Register Form:<br> 
        <form action='".$PHP_SELF."' method='post'> 
        <table> 
        <tr><td>Name</td><td><input type='textfield' name='username'></td></tr> 
        <tr><td>Password</td><td><input type='textfield' name='password'></td></tr> 
        <tr><td colspan=2><input type='submit' value='Register!'></td></tr> 
        </table> 
        </form>"; 
  } //end if 
//now we error trap the empty set 
} else { 
   //send out appropriate resonpse 
  echo 'user not found in database please try again.' 
} //end if 
?> 

For mysql_db_query() look in the manual and you will find:

Note: This function has been deprecated since PHP 4.0.6. Do not use this function. Use mysql_select_db() and mysql_query() instead.

Hope it helped.

[helz]

in connect.php is this:

connect to database

$cid = mysql_connect($host,$usr,$pwd);
if (!$cid) { echo("ERROR: " . mysql_error() . "\n"); }

mysql_select_db ($db);

// back to the register.php

$result = mysql_db_query($db,$sql,$cid);

##############Update#####################

I tried different methods but it still doesnt work.

even though mysql_db_query isnt used anymore, it still works.

[Hawk2005]

Now this will work:

register.php

function showForm() {
    echo "Register Form:<br> 
        <form action='".$PHP_SELF."' method='post'> 
        <table> 
        <tr><td>Name</td><td><input type='textfield' name='username'></td></tr> 
        <tr><td>Password</td><td><input type='textfield' name='password'></td></tr> 
        <tr><td colspan=2><input type='submit' value='Register!'></td></tr> 
        </table> 
        </form>";
}

if ($REQUEST_METHOD=="POST") {
	#$rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username' AND password = '$password'",$cid);
	//make sure theres only diffrent usernames. The above would make it possible to have karl : password and karl : pass
	$rs = mysql_query("SELECT * FROM ".$membertable." WHERE username = '$username'",$cid);
	//if the user exists 
	if (mysql_num_rows($rs)>0) {  

		echo("The user already exists, please try again<br><br>".$back."");
		showForm();  

    } 
	else {  

      	//the user does not exist set him into the user table 
      	mysql_query("INSERT INTO ".$membertable." (username, password) VALUES ( '$username', '$password'  ) ");      

      	echo("You have registered!");  

    } //end if 
}
else {  

	showForm(); 
} //end if 

[helz]

SUPERB!

quoted from somewhere ?
I love it when a plan comes together