Problem with Simple Authentication Script and $submit

Neubie

I got this php script from a book essential PHP for web professionals.

Unfortunately this does not work, because as soon as it is run, the if statement is run as if that submit is set, when it is not. I don't know but could this be because of global variables are turned off? Like I said it acts as if $submit is set.

neubie

Code is below:

<html>
<head>
<title>Password Checking Script</title>
</head>
<body>
<?php
function print_form() {
?>
<form action="check_password.php3" method="POST">
<h3>Please Login</h3>
User Name: <input type="text" name="user_name">
<br>Password: <input type="password" name="password">
<input type="submit" name="submit" value="Login!">
</form>
<?
}

if(isset($submit)):
if(!$db = mysql_connect("localhost","root")):
print("<h1>Can't Connect to the DB!</h1>\n");
else:
mysql_select_db("php3", $db);
endif;
$sql = "select * from users where user_name = '$user_name'";
$result = mysql_query($sql);
$row_count = mysql_num_rows($result);
if($row_count == 0):
?>
<h3>Wrong User Name! Try Again</h3>
<?
print_form();
else:
$row = mysql_fetch_array($result);
if($password != $row["user_password"]):
?>
<h3>Incorrect Password! Try Again</h3>
<?
print_form();
else:
?>
<h3>Password Accepted!</h3>
<?
endif;
endif;
else:
print_form();
endif;
?>
</body>
</html>

LordShryku

It's best to code as if register_globals is off, even if they are on. It makes your scripts compatible either way. Also, the use of curly braces ( } { ) instead of colons is much easier. And lastly, seperating your variables from the string ("say ".$blah; instead of "say $blah"😉 is a good practice to get in to now that will save you many headaches later on. Take o instance the following code. It is the same as yours, only with these principals applied

<?
if(isset($_POST['submit'])) {
   $db = mysql_connect("localhost","root");
   if(!$db) {
      print("<h1>Can't Connect to the DB!</h1>\n");
   }
   else {
      mysql_select_db("php3", $db);
   }

   $sql       = "select * from users where user_name = '".$_POST['user_name']."'";
   $result    = mysql_query($sql);
   $row_count = mysql_num_rows($result);

   if($row_count == 0) {
?>
<h3>Wrong User Name! Try Again</h3>
<?
      print_form();
   }
   else {
      $row = mysql_fetch_array($result);
      if($_POST['password'] != $row["user_password"]) {
?>
<h3>Incorrect Password! Try Again</h3>
<?
         print_form();
      }
      else {
?>
<h3>Password Accepted!</h3>
<?
      }
   }
}
else {
   print_form();
}

HTH

Neubie

Thanks for clarifying that for me. I thought I would need http_get _vars.