Log-in script not working

mak-uk

Hi all,

I am trying to write a log-in page and I had an error with mysql_num_rows() not working. I thought I fixed it, however, now when I click 'log-in' it simply days the query with the following code:

echo "\n<br>Query: " . $sql . "\n<br>";

and it is not allowing entry desipite specifying the correct email/password information:

<?php // index.php 
session_start();
include_once './inc/db.php';

$uid = isset($_POST['mEMail']) ? $_POST['mEMail'] : $_SESSION['mEMail']; 
$pwd = isset($_POST['mPassword']) ? $_POST['mPassword'] : $_SESSION['mPassword'];

if(!isset($_SESSION['mEMail'])) { 
$_SESSION['mEMail'] = ''; 
} 

if(!isset($_POST['SUBMITFORM'])) { 
?> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>blah blah</title>
...
</html>
<?php
}
else { 
$_SESSION['mEMail'] = (string) $_POST['mEMail']; 
$_SESSION['mPassword'] = (string) $_POST['mPassword']; 
} 
$sql = "SELECT * FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'"; 
$result = mysql_query($sql) or die(mysql_error()); 
cho "\n<br>Query: " . $sql . "\n<br>";
if (!$result) { 
 echo('A database error occurred while checking your '. 
       'login details.\\nIfhis error persists, please '. 
       'contact [email]me@me.com[/email].'); 
}

if (mysql_num_rows($result) == 0) { 
 unset($_SESSION['mEMail']); 
 ?> 
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
 <html xmlns="http://www.w3.org/1999/xhtml"> 
 <head> 
 <title> Access Denied </title> 
 <meta http-equiv="Content-Type" 
   content="text/html; charset=iso-8859-1" /> 
 </head> 
 <body> 
 <h1> Access Denied </h1> 
 <p>Your user ID or mPassword is incorrect, or you are not a 
    registered user on this site. To try logging in again, click 
    <a href="<?=$_SERVER['PHP_SELF']?>">here</a>. To register for instant 
    access, click <a href="join.php">here</a>.</p> 
 </body> 
 </html> 
 <?php 
 exit; 
}
?>

Any ideas please?

Thanks.

Mak 🙂

nunomira

hi,

don't understand what you mean in the first piece of your post.

In your code you have

cho "\n<br>Query: " . $sql . "\n<br>"; 
// where it should be
echo "\n<br>Query: " . $sql . "\n<br>";

and although this is correct, wouldn't it a better idea testing:

if (mysql_num_rows($result) !== 1) { 
 unset($_SESSION['mEMail']);

i.e., you're supposed to have one result only in case the user exists.

mak-uk

I mean, initially I had an error with mysql_num_rows() which I fixed.

When ammending it thus:

if (mysql_num_rows($result) !== 1) {  

 unset($_SESSION['mEMail']);

I try logging in with a valid e-mail and password and all that happens is that the query is printed:

Query: SELECT * FROM members WHERE mEMail = 'test@test.com' AND mPassword = 'd5661f8f9ff3c9ed5e01d6aa319cb782'

What am I doing wrong here? Unless it is actually working fine and now I need to display something like: "You are logged in"? If so, where would be the best place for this?

Thanks.

Mak 🙂

nunomira

ah, yes
You don't have code to welcome the user.

Add an else :

<?php // index.php
session_start();
include_once './inc/db.php';

$uid = isset($_POST['mEMail']) ? $_POST['mEMail'] : $_SESSION['mEMail']; 
$pwd = isset($_POST['mPassword']) ? $_POST['mPassword'] : $_SESSION['mPassword'];

if(!isset($_SESSION['mEMail'])) { 
	$_SESSION['mEMail'] = ''; 
} 

if(!isset($_POST['SUBMITFORM'])) { 
?> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>blah blah</title>
...
</html>
<?php
}
else { 
$_SESSION['mEMail'] = (string) $_POST['mEMail']; 
$_SESSION['mPassword'] = (string) $_POST['mPassword']; 
} 
$sql = "SELECT * FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'"; 
$result = mysql_query($sql) or die(mysql_error()); 
echo "\n<br>Query: " . $sql . "\n<br>";
if (!$result) { 
 echo('A database error occurred while checking your '. 
       'login details.\nIfhis error persists, please '. 
       'contact [email]me@me.com[/email].'); 
}

if (mysql_num_rows($result) !== 1) {  // not valid information
 unset($_SESSION['mEMail']);
 ?> 
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title> Access Denied </title>
<meta http-equiv="Content-Type"
   content="text/html; charset=iso-8859-1" />
</head>
<body>
<h1> Access Denied </h1>
<p>Your user ID or mPassword is incorrect, or you are not a
    registered user on this site. To try logging in again, click
    <a href="<?=$_SERVER['PHP_SELF']?>">here</a>. To register for instant
    access, click <a href="join.php">here</a>.</p>
</body>
</html>
 <?php 
 exit; 
}
else // valid information
{
 // welcome! you'r logged in
}
?>

mak-uk

Thanks for that.

I have decided to it as follows:

else { 

// valid information here
echo '<h3>You are now being logged in..</h3>';
include 'gotowelcome.html'; 
}
?>

gotowelcome.html simply redirects the user to welcome.php.

In welcome.php I want to say to the user: "Welcome username, thanks for logging in.

However, the only session variables I register previously are the ones that user uses to log in with: e-mail and password. Therefore, how would I go about putting the above welcome message to the user?

Thanks.

Mak 🙂

Weedpacket

I'd suggest not using mysql_num_rows. Instead, use the query "SELECT COUNT() FROM members WHERE ....". That will return one row with one field. Use mysql_fetch_row() to get the row, and look at the (sole) element in it. That will give you the information that you're after, and will save a lot of processing.

$sql = "SELECT COUNT(*) FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'"; 
$result = mysql_query($sql);   // Don't forget to drop the mysql_error() bit when you go live.
$row = mysql_fetch_row($result);
$count = $row[0];
if($count!=1)
{....}

nunomira

following weedpacket's suggestion, get the username from the database, it's there, isn't it? and store it in a session variable.

$sql = "SELECT COUNT(*), username FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'"; 
$result = mysql_query($sql);   // Don't forget to drop the mysql_error() bit when you go live.
$row = mysql_fetch_row($result);
$count = $row[0];
if($count!=1)
{
// ...
$_SESSION['username'] = $row[1];
}

Then you can use $_SESSION['username'], after starting the session with session_start();

mak-uk

Thanks for that guys but can you quickly explain the logic to this part to aid my understanding:

$row = mysql_fetch_row($result); 
$count = $row[0]; 
if($count!=1) 
{ 
// ... 
$_SESSION['username'] = $row[1]; 
}

For example, what exactly does the mysql_fetch_row() statement do and what are we doing to it with $count = $row[0];.

Thanks.

Mak 🙂

nunomira

mysql_fetch_row()
" Returns an array that corresponds to the fetched row, or FALSE if there are no more rows"

so, when you have

"SELECT COUNT(*), username ..."

the row/array has count(*) in the first position, hopefully with the value 1, i.e., 1 user found, and her username in the second position.

first position:
$row[0];
which is used in the if()

second position:
$row[1];
which is used to store the username in a session variable

Like I said, I assumesd that you have a column called username in this database.

mak-uk

Thanks.

When modifying and executing the script I get:

Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in index.php on line 205

Access Denied
Your user ID or mPassword is incorrect, or you are not a registered user on this site. To try logging in again, click here. To register for instant access, click here.

Line 205 is: $row = mysql_fetch_row($result); of:

$sql = "SELECT COUNT (*) FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'";
$result = mysql_query($sql);   // Don't forget to drop the mysql_error() bit when you go live. 
$row = mysql_fetch_row($result); 
$count = $row[0]; 
if($count!=1) {
  unset($_SESSION['mEMail']);
 ?> 
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
 <html xmlns="http://www.w3.org/1999/xhtml"> 
 <head> 
 <title> Access Denied </title>

Any ideas why that is?

Thanks.

Mak 🙂

nunomira

it's
SELECT COUNT() FROM
not
SELECT COUNT () FROM

mak-uk

Thanks for that.

Would it, therefore, be possible to do something along these lines:

else { 
$getwelcomevars="SELECT COUNT(*), mForename, mSurname FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'";  

$result = mysql_query($getwelcomevars);
$row = mysql_fetch_row($result); 
$_SESSION['mForename'] = $row[1];
$_SESSION['mSurname'] = $row[1];

echo '<h3>You are now being logged in..</h3>';
include 'gotowelcome.html';
}
?>

Thanks.

Mak 🙂

nunomira

no,

I was wrong about that!
You can't use count and then the other columns. This is not possible:

"SELECT COUNT(*), username ..."

In this case, I'd go back to mysql_num_rows() and just use:

"SELECT mForename, mSurname FROM..."

Maybe you can still do it just using SQL, but I don't know how.

mak-uk

Okay, so I am changing it back to:

$sql = "SELECT * FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'"; 

$result = mysql_query($sql) or die(mysql_error()); 

echo "\n<br>Query: " . $sql . "\n<br>";
if (!$result) { 
 echo('A database error occurred while checking your '. 
       'login details.\\nIfhis error persists, please '. 
       'contact [email]me@me.com[/email].'); 
}

if (mysql_num_rows($result) !== 1) {  

 unset($_SESSION['mEMail']);
?> 
  <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 
 <html xmlns="http://www.w3.org/1999/xhtml"> 
 <head> 
 <title> Access Denied </title> 
...
 </html> 
 <?php 
 exit; 
}

Now, after this would be possible to add mForename and mSurname (from the members table) so I can say "Hi mForename mSurname" on the next page?

else { 
$_SESSION['mForename'] = $mForename; 
$_SESSION['mSurname'] = $mSurname; 
echo '<h3>You are now being logged in..</h3>';
include 'gotowelcome.html'; 
}
?>

Thanks.

Mak 🙂

nunomira

you use mysql_fetch_assoc() for example:

else { 
$row = mysql_fetch_assoc ($result);
$_SESSION['mForename'] = $result['mForename']; 
$_SESSION['mSurname'] = $result['mSurname']; 
echo '<h3>You are now being logged in..</h3>';
include 'gotowelcome.html'; 
}
?>

supposing that the column names are mForename and mSurname.

nunomira

and you may only look for the two parameters you want:

$sql = "SELECT mForename, mSurname FROM members WHERE mEMail = '$uid' AND mPassword = '".md5($pwd)."'";

Weedpacket

Originally posted by nunomira
no,

I was wrong about that!
You can't use count and then the other columns. This is not possible:
"SELECT COUNT(*), username ..."
[/B]

Matter of fact you can: you just need to tack " GROUP BY username" on the end of the query. But it isn't necessarily a good idea to get the username or other data as well: if there are no matches then what is the database supposed to return for those additional fields? If I recall rightly, the result will be that no rows are returned at all, and you're back where you started. But if all you're trying to do is see if there are matches, then all you need is the count.