Authorisation system

idnoble

Hello

I'm trying to create an authorisation system with 2 different access levels, levels 1 and 2 I have created a php script and an html page to run this function each time i try load the htnl form in my browser and fill the form it always loads the php script (which is a good thing a that is what its supposed to do but the php page always displays this error message:

Parse error: parse error, unexpected $end in d:\phpweb\admin_system\adminlogin.php on line 20

it seems i ended the script illegally, i don't know what else to add please help me out, the scripts are below

here's the php script

<?php
if ($submit)
$session = mysql_connect("localhost", "username", "password");
mysql_select_db("xplosive");
$sql = "
SELECT Auth
FROM Staff
WHERE Username = '$username'
AND Password = '$password'
";
$result = mysql_query($sql);
while ($row = mysql_fetch_array($result)) {
$auth = $row["auth"];
If (!mysql-num-rows($result)) {
echo "ACCESS DENIED: Invalid Login details";
}
If ($auth == "1") {
echo "You are logged in with a level 1 authorisation.<br/>
<a href='admin.php'>Click here to continue</a>";
?>

and here's the html code

<html>
<head> <title> ADMIN LOGIN </title> </head>
<body>
<form method="POST" action="adminlogin.php" ENCTYPE="multipart/form-data">
Name:<input type="text" name="username"><br/>
<br/>
Password: <input type="password" name="password">
<br/>
<input type="submit" name="submit" value="LOGIN">
</form>
</body>
<html>

mrhappiness

i normally don't like having to search for a specific line of code

why don't you use those marvelous

 tags?[*]it has to be mysql_num_rows and not mysql-num-rows[*]count the occurences of { and the occurences of }
i'm pretty sure they differ fromeach other[/list]

idnoble

Hey thank you, I've made the corrections i actually missed 1 braces, but after i tried it now it using an invalid login id, it shows 2 new error message and went on to display the initial invalid login details message, i'm bummered 🙁 .

here are the new error messages:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in d:\phpweb\admin_system\adminlogin.php on line 12

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in d:\phpweb\admin_system\adminlogin.php on line 14
ACCESS DENIED: Invalid Login details

mrhappiness

cchange

$result = mysql_query($sql);

$result = mysql_query($sql) or die('<hr />'.$sql.'<hr />'.mysql_error());

what happens?

idnoble

I've made the changes and i ca,e up with this:

hr /> SELECT Auth FROM Staff WHERE Username = '' AND Password = ''

No Database Selected

i typed a semicolon ; at the end of or die and the browser came up blank

mrhappiness

Originally posted by idnoble

SELECT Auth FROM Staff WHERE Username = '' AND Password = ''

No Database Selected

seem's like you did not select a database
make use of

mysql_select_db('xplosive') or die(mysql_error());

what happens now

furthermore the script doesn't have the correct values for username and password
do

$username = $_POST['username'];
$password = $_POST['password'];
$sql = 'your select goes here';

idnoble

Hello
I have made the changes you pointed out and got another error which is below:

Parse error: parse error, unexpected T_STRING in d:\phpweb\admin_system\tmp25zb3v131d.php on line 8

The script as it is currently is dislayed below:

<?php
if ($submit)
$session = mysql_connect ("localhost", "Username", "Password");
mysql_select_db("xplosive") or die(mysql_error());
$sql = '
SELECT Auth
FROM Staff
WHERE $Username = $POST['Username'];
AND $Password = $POST['Password'];
';
$result = mysql_query($sql) or die
('hr />' .$sql.'<hr />'.mysql_error());
while ($row = mysql_fetch_array($result)) {
$auth = $row["auth"]; }
if (!mysql_num_rows($result)) {
echo "ACCESS DENIED: Invalid Login details";
}
if ($auth == "1") {
echo "You are logged in with a level 1 authorisation.<br/>
<a href='admin.php'>Click here to continue</a>";
}
?>

And please what is a T_STRING error?
Thanx

k9underdog

$sql = ' 
SELECT Auth 
FROM Staff 
WHERE $Username = $_POST['Username']; 
AND $Password = $_POST['Password']; 
';

Try

$sql = " 
SELECT Auth 
FROM Staff 
WHERE $Username = '{$_POST[Username]}'; 
AND $Password = '{$_POST[Password]}'; 
";

You should also check the slashes to prevent SQL injection, ie:

$_POST['Username'] = addslashes($_POST['Username']);
$_POST['Password'] = addslashes($_POST['Password']);
$sql = "...";

Hope this helps.