can't get login.php to work ...

[Francky683]

Hi everybody,
I started a php site some weeks ago and i completed my registration page... Now i want a login page but i can't get it to work ... here is my code :

<?php
session_start(); 
header("Cache-control: private"); 
if($login)
{
include 'db.php';
$user = mysql_query("SELECT * FROM users WHERE username='$username'"); 
$user2 = mysql_fetch_array($user); 
if(mysql_num_rows($user) > 0) { if($user2['encryptedpass'] = md5($pass)) { $loggedin = 1; session_register($loggedin); echo "You are now logged in! Hurray! <a href=\"page1.php\">page1.php</a> <br> \n"; } 
								else { echo "Hm...I sense someone who can't type or wants to be somewhere they shouldn't be. Bad password."; } 
							  } 
else { echo "Oops...I can't find that username! <br> \n"; } 
}

else{
?> 
<form action="<?php echo $PHP_SELF ?>" method="POST"> 
Username: <input type="text" name="username"> <br> 
Password: <input type="password" name="pass"> <br> 
<input type="submit" value="login"> 
</form> 
<?php 
} 
?>

What's wrong with it ???

Thanks,

~Francky683~

[leatherback]

eerh..

a few points:
- Assume when coding that register_globals is switched off. So use $_POST[login] etc to retrieve posted variables. That might be one problem.

The other: If you give a name to a button, and check for it, it may give you a false, even when the button has been presed. it is safer to use a hidden variable to see wether the form has been submitted

Try to clean your code: add linebreaks, indenting etc to you rcode, so you can see the structure more easily, which will help debugging (Especially needed when dealing with larger sites!

J.

[Francky683]

i cleaned it a lil bit ...

 <?php 
session_start(); 
header("Cache-control: private"); 

/*/Page content/*/ 

if($submit) {
	include 'db.php';
	$user = mysql_query("SELECT * FROM users WHERE username='$username'"); 
	$user2 = mysql_fetch_array($user); 
	if(mysql_num_rows($user) > 0) { 
		if($user2['encryptedpass'] = md5($pass)) { 
			$loggedin = 1; 
			session_register($loggedin); 
			echo "You are now logged in!\n"; 
		} 								
		else{ 
			echo "Hm...I sense someone who can't type or wants to be somewhere they shouldn't be. Bad password."; 
		} 
	} 
	else{ 
		echo "Oops...I can't find that username!\n"; 
	} 
}

/*/ Login Form /*/

else{
?> 

<form method="post" action="<?php echo $PHP_SELF ?>"> 
<table>
	<tr>
		<td>Username:</td>
		<td><input type="text" name="username"></td>
	</tr>
	<tr>
		<td>Password:</td>
		<td><input type="password" name="pass"></td>
	</tr>
</table>
<table>
	<tr>
		<td align="center"><input type="submit" name="submit" value="login"></td>
	</tr>
</table>
</form> 
<?php 
} 
?>

[parawizard]

whats going wrong? what part of it isnt working>?

[leatherback]

replace

    $user = mysql_query("SELECT * FROM users WHERE username='$username'");  

    $user2 = mysql_fetch_array($user);  

    if(mysql_num_rows($user) > 0) {  

        if($user2['encryptedpass'] = md5($pass)) {  

            $loggedin = 1;  

            session_register($loggedin);  

            echo "You are now logged in!\n";  

        } 

with

    $user = mysql_query("SELECT * FROM users WHERE username='$username'");  

while($user2 = mysql_fetch_array($user))
  {
  $pass = $user2['encryptedpass'];
  }
   if($pass == md5($pass)) 
            {  

            $loggedin = 1;  

            session_register($loggedin);  

            echo "You are now logged in!\n";  

            }

and it should work a lot betetr