Sessions...validate session?

[gat]

Hello, this is my website.
http://cars.uk-graffiti.co.uk

The aim of the site is that its dynamic to different users.
Ie, the home page will change according to your continent.

which is taken in regestration.

My problem:
on the login screen, you can enter and two values and a session will be started.

My code checks that user name and password are the same as in the database, but its not working.
could someone take a look please

<?PHP
session_start();
include 'scps_db.php';
$username = $_POST['username'];
$password = $_POST['password'];

if((!$username) || (!$password))
{
	echo "Please enter ALL of the information! <br />";
	exit();
}
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password' ");
$login_check = mysql_num_rows($sql);

if($login_check =1)
{
	while($row = mysql_fetch_array($sql))
	{
		$f_name = $row['f_name'];
		$s_name = $row['s_name'];
		$location = $row['location'];
		$age = $row['age'];
		$email = $row['email'];
	}
	$_SESSION['f_name'] = $f_name;
	$_SESSION['s_name'] = $s_name;
	$_SESSION['email'] = $email;
	$_SESSION['location'] = $location;
	$_SESSION['age'] = $age;
	$_SESSION['username'] = $username;
}
else
{
	echo "You could not be logged in! Either your username and password do not match, or your password is incorrect!<br/>Please try again!<br />";
}
?>

[devinemke]

what's the error?

[gat]

the problem is that on the login screen, you can enter any two values and the next screen "login_check.php" will display the session username. Instead of Echoing

echo "You could not be logged in! Either your username and password do not match, or your password is incorrect!<br/>Please try again!<br />";

its not checking the user inputs with the database?

[cbj4074]

I'll post some of my own code (which shouldn't be taken for gospel by any means)... but it does pretty much exactly what you're talking about. A couple lines are specific to my own setup here, but you should be able to pull what you need from it.

I suspect you're running into problems because your passwords are stored as MD5 hashes or what have you, and you're supplying them as plaintext in the form data.

$db = mysql_connect('localhost', 'username', 'password') or die("Couldn't connect to the database."); //connects to the database
mysql_select_db('my_db') or die("Couldn't select the database.");

//add slashes to the username (which prevents error from people who have non-alpha-numberic passwords), and make an md5 checksum of the password
$_POST['User_Name'] = addslashes($_POST['User_Name']);
$_POST['Password'] = md5($_POST['Password']);

$result = mysql_query("SELECT count(userid) FROM users WHERE userpass='$_POST[Password]' AND username='$_POST[User_Name]'") or die("Couldn't query the user-database."); //submits the credentials to the DB
$num = mysql_result($result, 0); //stores the results of row x, cell 0
mysql_close($db); //closes the connection to the database

if (!$num) { //if the credentials didn't match (i.e. the query didn't return anything)...
	//display the login form
	include($pathtoroot . 'subnav1.inc.php');
	include('login_form.inc.php');

	if (($_POST['firstrun'])) { //this is what happens if the user/pass combo doesn't match anything in the database after a login attempt
		echo '<div id="error" style="position:absolute; left:373px; top:265px; width:1px; height:1px; z-index:1"><table width="200" cellpadding="0" cellspacing="0" border="0"><tr><td class="warning">';
		echo 'The user name/password combination you supplied is invalid. Please try again.';
		echo '</td></tr></table></div>';
	}

} else {

//start the login session
session_start();

//we've already added slashes and MD5'd the password
$_SESSION['User_Name'] = $_POST['User_Name'];
$_SESSION['Password'] = $_POST['Password'];

//any text output below this line will be displayed to the users that are authenticated
//or, you can just redirect the user and not output anything, which is what I've done here

if ($_SESSION['referer'] == $PHP_SELF) {
	header('Location: ../members/members.php');
}
else {
	$url = $_SESSION['referer'];
	header("Location: $url");
}
}

include($pathtoroot . 'subnav2.inc.php');