why wont this login code work?

[ejwf]

I have this code for a login page

if (isset($_POST['submit']))	
{
require_once ('../mysql_connect.php');	

//check username is in correct format
if (eregi ("^[[:alpha:].' _-]{2,20}$", stripslashes(trim($_POST['username']))))
{
$username = $_POST['username'];
}
else
{
echo '<p><font color="red"> Please enter valid Username </font></p>';
}
 // check user name has been entered
if (empty($_POST['username']))
{
echo '<p><font color="red"> You forgot to enter your username.</font></p>';
}
else
{
$username = $_POST['username'];
}

// check password is in valid format
if (eregi ("^[[:alnum:]]{4,80}$", stripslashes(trim($_POST['password']))))
{
$password = $_POST['password'];
}
else
{
echo '<p><font color="red"> Please enter a valid password</font></p>';
}

// check password has been entered
if (empty($_POST['password']))
{
echo '<p><font color="red"> You forgot to enter your password.</font></p>';
}
else
{
$password = $_POST['password'];
}

if ($username && $password)					// everything is OK
{					
$query = "SELECT UserId FROM tblUser                      

    WHERE CLogIn='$username'
    AND CPass='$password'";		 
    $result = @mysql_query($query); 
    $row = mysql_fetch_array ($result, MYSQL_NUM);

if ($row)  // username and password match database records   

 {         // start the session, register the values and redirect
	session_start();
	$_SESSION['username'] = $username;	 


header ("Location: [url]http://www.***.com/***/authority.php[/url]");

}
else	   // no match was made
{
echo '<p><font color="red">The Username and Password you entered do not match those on file.</font></p>';
}

}
else				// if everything wasn't OK
{
echo '<p><font color="red">Please try again</font></p>';
}
}

include ('header.htm');

?> 
<h1><font face="Arial, Helvetica, sans-serif"><img src="images/***.jpg" width="134" height="50" align="middle"> 
Login</font></h1><form action="authority.php" method="post"> <fieldset><legend><font face="Arial, Helvetica, sans-serif">Please 
Enter Your Information Below;</font></legend> <p><font face="Arial, Helvetica, sans-serif" size="3"><b>Username:</b> 
<input type="text" name="username" size="30" maxlength="60" value="<?php if(isset($_POST['username'])) 
	echo $_POST['username'];?>" /></font> <p><font face="Arial, Helvetica, sans-serif" size="3"><b>Password:</b> 
<input type="password" name="password" size="30" maxlength="60" /> </font></p><br> 
<div align="center"> <input type="submit" name="submit" value="Submit" /></div></form><p> 
<font face="Arial, Helvetica, sans-serif" size="3" color="#FF0000">Note</font><font face="Arial, Helvetica, sans-serif" size="3">: 
Your Username is the first part of your e-mail address.<br> example - for the 
e-mail address; [email]joe_bloggs@***.com[/email], the user name would be joe_bloggs.</font><br> 
</p>

The code works, if you put in a 'correct' username and password it sends you to the correct place in the website.
BUT it also sends you to a page in the website even if you put in 'superman' as both username and password - which is not a valid login based on the mysql database info - basically it lets anyone in.

I need a secure login system - where am I going wrong - thanks

[sanam]

First of all dont use @ sign in front of mysql_query. This will not generate any error, and you dont want that.

Simple solution would be:

change
$result = @($query);
$row = mysql_fetch_array ($result, MYSQL_NUM);

if ($row) // username and password match database records

{ // start the session, register the values and redirect
session_start();
$_SESSION['username'] = $username;

header ("Location: <a href="http://www..com//authority.php" target="_blank">[url]http://www..com//authority.php[/url]</a>");

}
else // no match was made
{
echo '<p><font color="red">The Username and Password you entered do not match those on file.</font></p>';
}

$result = mysql_query($query);
if (!$result) {
die('Invalid query: ' . mysql_error());
}
$rows = mysql_num_rows($result);

if ($rows != '1') // username and password did not match database records

{
echo '<p><font color="red">The Username and Password you entered do not match those on file.</font></p>';
exit;
}else{ // start the session, register the values and redirect
session_start();
$SESSION['username'] = $username;

header ("Location: <a href="http://www..com//authority.php" target="blank">[url]http://www..com//authority.php[/url]</a>");

}

There are lot of login scripts that you can use/modify , have a look at them.

[ejwf]

thanks for your reply but this code still lets me in with an incorrect username and or password.

also I kept getting a parse error on the header line;
"Location: <a href="http://www..com//authority.php" target="_blank">[url]http://www..com//authority.php[/url]</a>");

but it works if I change it to;
header ("Location: [url]http://www..com//authority.php[/url]");

I have looked and tried many different codes for this login page, they all work, but they all let me log in with usernames that
aren't on the database.

My problem is I don't know how to tighten up this code to stop this from happening - can anyone help please