login script problem

[fimbria]

Hello,
I have the following "login" script, which isn't working at the moment. When the details are submitted to the database, it always returns that the details can not be recongised, even though i know that the records username (uname) and password (pword) do exist.

The main login script is below and the two external function in a seperate wrapperclass, can be found after the script.

<?php

   include "wrapperclass.php";

if($content=="login"){


if (isset($_POST['pword'])) {

   //encrypt password

   $pw = md5($_POST['pword']);

   //check username and password exists in dbase

   //make an object of the wrapperclass
				$forum=new ForumInterface();

			//make db connection
			$forumpointer=$forum->connect();

			//insert record
			$forum->checkUsername($uname, $pw);

			//disconnect to db
			//$forum->Disconnect($forumpointer);



   //if rows not 0 then username details correct
   if ($checkaccess !=0)  {

   //set session
   session_start();
   session_register("$uname");
   session_register("$pword");

   //disconnect
   $forum->Disconnect($forumpointer);  


 //make an object of the wrapperclass
				$forum=new ForumInterface();

			//make db connection
			$forumpointer=$forum->connect();

			//insert record
			$forum->getaccesslevel($uname, $pw);

while ($row=mysql_fetch_assoc($rs))
{

$UserAccount = $row['UserAccount'];

}

			//disconnect to db
			$forum->Disconnect($forumpointer);


session_register("$UserAccount");




//directing to pages
header("Location: admin.php");


} else { 

$loginstatus="failed";    
   }
}

}

?>

Which has the following two external functions included:-

//check whether user exists in the table

function checkUsername($uname, $pw) { 

   $sql= "SELECT COUNT(*) AS count FROM userarea
        WHERE Username= '$uname'AND Password='$pw'";

$result = mysql_query($sql); 
$checkaccess = mysql_result($result, 0, 'count'); 
return $checkaccess; 
}


//get user access level

function getaccesslevel($uname, $pw)
	{
	 		$rs = mysql_query("SELECT UserAccount FROM userarea WHERE
Username='$uname' AND Password='$pw'") or die(mysql_error());
		  return $rs;
	}

Hopefully, someone can see where im going wrong.....

Thanks

[Pig]

I see you passing 2 vars:
$forum->checkUsername($uname, $pw);

But I don't see you coming up with $uname from anywhere. Is it passed from a form? If you have register globals off, then you need to do:
$forum->checkUsername($_POST['uname'], $pw);

[fimbria]

yeah, sorry i didn't explain..

I have got a form with the two variables mentioned, this is as so:-

<FORM action="?content=login" method="post">

Username:<BR><INPUT type="text" maxLength="10" name="uname" value="">

<br />

Password:<BR><INPUT type="password" maxLength="10" name="pword" value="">                

<br />
<input type=hidden name=checklogin value=joe>



<input type="hidden" name="id" value="">              

<INPUT type=submit value=Enter>

As far as i know registered globals is "on", would it help if i defined the variables, like so:-

$uname = $POST['uname'];
$pword = $POST['pword'];

Thanks again

[Pig]

You can either check the php.ini file, or do a quick test:
if( empty($uname) && !empty($_POST['uname']) ) echo("Globals is off");

In general, you should have auto globals off since it is a security risk.

Yes you may turn them into auto globals, but why not just pass the $_POST var?

[fimbria]

thanks,

very true...

but im still having problems trying to get the script to work properly....

[fimbria]

found the problem.....

I wasn't returning the $checkaccess variable correctly... i had put

$forum->checkUsername($uname, $pw);

but it should of been...

$checkaccess = $forum->checkUsername($uname, $pw);

Thanks for the help...

Just need to work out how to return the $useraccount field seperately....?