Custom errors won't show.

[mabans]

I have it setup so if someone tries to log in and inputs the wrong password you get the apporiate error back at the sign in page. The Same results will happen when a non existant username is input into the Username and pass. BUT! When I do input the correct username and pass it works just fine. Here is the code. Any thoughts?

session_start();
session_register('auth');
session_register('logname');

$uname = strtolower($_POST['uname']);
$passwd = md5(strtolower($_POST['passwd']));


//The Required Files to access the data base
include("../../includes/configs/config.cfg");
include("../../includes/configs/select_db.cfg");

$sql = "SELECT loginName FROM Members WHERE loginName='$uname'";
$results = mysql_query($sql) or die();
$num = mysql_numrows($results) or die();

if ($num == 1) // This means if the login was found.
	{
	$sql2 = "SELECT loginName FROM Members WHERE loginName='$uname' AND password = '$passwd'";
	$results2 = mysql_query($sql2) or die ();
	$num2 = mysql_numrows($results2) or die();

	if ($num2 > 0) // This is true if the password is correct
		{
		$auth ="yes";
		$logname = $uname;
		header("Location: members_only.php");
		}
	else // This is if the Password is incorrect
		{
		$error_message = "The Password you entered for $uname is incorrect! Please try again.<br>";
		include("sign_in.php");

		}
}
elseif ($num == 0) // This is if the usename does not exist
	{
	$error_message ="The Username you have entered does exist! Please try again.<br>";
	include("sign_in.php");


}
?>

I purposely put in a wrong password or username I get a blank page rather than the else statements where it go back to the sign in page with the addtional error code, I get a blank page.

http://69.13.156.225/

I will not give out the username and pass to demonstrate the problem I am having.

I have done a similar thing the User sign up page with no problem

http://69.13.156.225/includes/members/sign_up.php

[LordShryku]

Well....what are you doing with $error_message? I don't see you ever actually diplaying it. Just setting it...

[mabans]

It gets used here. this is the code for the sign_in.php

 <form action="login.php" method="post" name="log_in" id="log_in">
  <table width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#000000">
    <?php    

		if (isset($error_message))
		{
		echo "<tr bgcolor=\"#CCCCCC\">" 
            ."<td colspan=\"2\">"
            ."<div align=\"center\"><font color=\"#000000\" size=\"2\" face=\"Verdana, Arial, Helvetica, sans-serif\">"
			."<strong>ERROR: "
			.$error_message
			."</strong></font></div></td></tr>";
		}
?>
    <tr>
    <td><table width="100%" border="0" cellpadding="0">
        <tr bgcolor="#663300"> 
          <td colspan="2"> <div align="center"><strong>Please enter your username 
              and password to log in.</strong></div></td>
        </tr>
        <tr bgcolor="#CCCCCC"> 
          <td>Username:</td>
          <td> <input name="uname" type="text" id="uname"></td>
        </tr>
        <tr bgcolor="#CCCCCC"> 
          <td>Password:</td>
          <td> <input name="passwd" type="password" id="passwd"></td>
        </tr>
        <tr bgcolor="#CCCCCC"> 
          <td colspan="2" bgcolor="#CCCCCC"><div align="center">
              <input type="submit" name="Submit" value="Login">
              <input name="reset" type="reset" id="reset" value="Reset">
            </div></td>
        </tr>
      </table></td>
  </tr>
</table>
</form>

[batman]

First of all a noticable mistake was with mysql_numrows if you want to use this it needs to be mysql_num_rows. Second why are you setting sessions before the user is logged in? This is how I would set up the code.

$uname = strtolower($_POST['uname']); 
$passwd = md5(strtolower($_POST['passwd'])); 

if((!$uname) || (!$passwd)){
	echo "<font color=\"red\"><b>Please enter ALL of the information!</b></font> <br />";
	include 'sign_in.php';
	exit();
}


//The Required Files to access the data base 
include("../../includes/configs/config.cfg"); 
include("../../includes/configs/select_db.cfg"); 

$sql = mysql_query("SELECT * FROM Members WHERE loginName='$uname' AND password='$passwd' "); 

$login_check = mysql_num_rows($sql);



if($login_check > 0){
	while($row = mysql_fetch_array($sql)){
	foreach( $row AS $key => $val ){
		$$key = stripslashes( $val );
	}		

	// Register some session variables!
	session_register('logedin');
	$_SESSION['logedin'] = true;





	header("Location: members_only.php");
}
}



else {
	echo "You could not be logged in! Either the username and password do not match or you provided a username that is not in our database!<br />
	Please try again!<br />";
	include 'sign_in.php';
}



?>

Then on the members only page you want to see if the session logedin is set or not.

Hope that helps,