User login needs checking

[brockie99]

i have written some basic code to login a user through their username (email) and their password, which are stored in the MySQL database, and it doesnt seem to work properly. The page i have written this code in is called 'index3.php', and i am trying to direct it to a page called index.php if the user login is successful!!

Can you please take a look at the code below and tell me where i am going wrong. The SQL i have written is correct, and i have used this code before on another web site and it works ok. Just cant seem to understand why it doesnt this time.

<?php

define("DBHOST","localhost");   //include the name of the dbhost,use for database connection
define("DBNAME","*******");   //include the username for connecting to database
define("DBPASS","******");   //include the password for connecting to database
define("DB","the-coff_maitland");       //database name that all tables are reside in  

if(isset($_COOKIE["id"]) && $_COOKIE["id"] == "member"){
	header("Location:index.php");
	exit;	
}
elseif(!isset($_POST["login"])){
	display();
	exit;
}
else{

	//checking if the user really input some character into the following field
	if(!strlen($_POST["id"])){
		$id = htmlspecialchars($_POST["id"]);
	}
	if(!strlen($_POST["pw"])){
		$pw = htmlspecialchars($_POST["pw"]);
	}

	$dblink = mysql_connect(DBHOST,DBNAME,DBPASS);
	mysql_select_db(DB);
	$query = "SELECT username, password FROM member";
	$result = mysql_query($query);
	$data = mysql_fetch_array($result);

	//If the password is matched to the one in database, grant access by setting cookie
	if($data[1] == $pw){
		setcookie("id", "member", time() + 1800);
		setcookie("username", $data[0], time() + 1800);

		mysql_close($dblink);
		header("Location:index.php");
		exit;        
	}

	mysql_close($dblink);	
}

//this function is to output the form
function display(){

?>

AND THE HTML CODE:

<table width="0%" border="0">
<form method="post"> <!--action="index3.php"-->
<tr>
<td width="50"><p class="leftBar">Username</p></td>
<td><input type="text" name="username" size="16"></td>
</tr>
<tr>
<td width="50"><p class="leftBar">Password</p></td>
<td><input type="password" name="password" size="16"></td>
</tr>
</table>

  <table width="92%" border="0">
	<tr>
	<td height="21"><a href="forgotPassword.php" class="leftBar">Forgotten Password?</a></td>
	<td align="center"><input type="image" value="submitname" src="images/submit.jpg" 
	border="0" alt="Click Here To Sign In" name="image"> 
	</td>
	</tr>
	</form> 
</table>

Thanks for your help

[Kudose]

Few things I noticed.

Your calling for $POST['id'] and $POST['pw'] but your form is passing username and password, not id & pw.

Your SQL would be better if instead of

SELECT username, password FROM members

it read

SELECT username, password FROM members WHERE username='$username' AND password='$password'

But, your problem probably lies in the way your form is built compared the the PHP you have written.

[brockie99]

what would happen if i changed the 'action' of the form?? originally i took it out of the form, and the page was not directed anywhere, but now i have started using the action as the same page, and also other pages eg) action ="index3.php" OR action = "index.php"

Do you think i will need to use action in my form for this login or not??

Thanks

[laserlight]

HTML requires the action attribute.

The action of the form would point to the script that would process the form.

[Kudose]

If you are posting to a form that is on the same page, than just use:

<form action="<?php $_SERVER['PHP_SELF']; ?>" method="post">

or

<form action="<? $PHP_SELF; ?>" method="post">

depending on your configuration for short tags.

[Roger_Ramjet]

See my post in this thread for a neat login security system http://www.phpbuilder.com/board/showthread.php?s=&threadid=10282984