PHP to flash array problem

[micmac]

Hi guys,
Having trouble displaying the following array from php.

<?
$user=$_POST['user'];
$pass=$_POST['pass'];

//connect to database
if ($user && $pass){
	mysql_pconnect("localhost","","") or die ("didn't connect to mysql");
	mysql_select_db("training") or die ("no database");
//make query

$query = "SELECT * FROM auth WHERE username = '$user' AND userpassword = '$pass'";
$result = mysql_query( $query ) or die ("didn't query");



//see if there's an EXACT match
$num = mysql_num_rows( $result );

$rString = "&n=".$num;

for ($i=0; $i < $num; $i++) {
	$row = mysql_fetch_array($result);
	$rString .= "&username".$i."=".$row['username']."&userpassword".$i."=".$row['userpassword'];
	$rString .= "&yourscore".$i."=".$row['yourscore'];
}
if ($num == 1)
{
print "status=You're in&".$r_string."&checklog=1";
}
else
{
print "status=Sorry, but your user name and password did not match a user name/password combination in our database.  Usernames and passwords are entered in from a different file.  Thank you for visiting test login script!!&checklog=2";
} 
}
?>

Any ideas on how to correct this. I have a feeling it is to do with this line:

print "status=You're in&".$r_string."&checklog=1";

Cheers,
micmac

[daveyboy]

you're trying to build a url. if you are, you should be calling urlencode() on all variable values to escape illegal characters (' ', "'" etc.).

also, if you are building a url, it's pretty dumb to put your users' passwords in it: they will be visible in server and proxy logs.

finally, your $rString would appear to begin with '&&'. perhaps you want '?'.