Whats wrong with my code?

hunkyjack

I have written the following code whilst creating a simple login script. My code is below completley unedited. The code links from a form which submits the username and password.

<?
$username = $HTTP_POST_VARS[ "username"];
$password = $HTTP_POST_VARS[ "password"];
if (!$username || !$password)
{
echo
?>
<html>
USERNAME/PASSWORD ERROR!
</html>
<?
exit;
}
@ $db = mysql_pconnect();
if ($db)
{
?>
<html>
DATABASE CONNECTION ERROR
</html>
<?
exit;
}
mysql_select_db("members");
$result = "SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."' ";
if (!mysql_num_rows($result))
{
echo
?>
<html>
USERNAME/PASSWORD ERROR!
</html>
<?
exit;
}
$inf = mysql_fetch_array($result);
session_start();
session_unset();
$username = $inf[ "username"];
$permissions = $inf[ "permissions"];
?>

Can anyone please tell me why it is I get a database connection error everytime I attempt to use this script. I am running mysql on localhost, and have just installed it, and not made any modifications to usernames/passwords that I am aware of.

chyan

you must supply you hostname,username and password if any
to connect to mysql

i'v been edited your script, here the result

<?
$database="yourdatabasenamehere"; // you're using member right? so fill it member 
$hostname="yourhostname"; //you can using localhost here
$user="yourdatabaseusername"; // since you havent edit your mysql instalation, you can using root here

$username = $HTTP_POST_VARS[ "username"]; 
$password = $HTTP_POST_VARS[ "password"]; 
if (!$username || !$password) 
{ 
echo 
?> 
<html> 
USERNAME/PASSWORD ERROR! 
</html> 
<? 
exit; 
} 
@ $db = mysql_connect($hostname,$user); 
if ($db) 
{ 
?> 
<html> 
DATABASE CONNECTION ERROR 
</html> 
<? 
exit; 
} 
mysql_select_db($database,$db); 
$query = "SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."' "; 
if (!mysql_num_rows($query)) 
{ 
echo 
?> 
<html> 
USERNAME/PASSWORD ERROR! 
</html> 
<? 
exit; 
} 
$result=mysql_query($query,$db);
$inf = mysql_fetch_array($result); 
session_start(); 
session_unset(); 
$username = $inf[ "username"]; 
$permissions = $inf[ "permissions"]; 
?>

hunkyjack

Thanks for the quick reply, however, I've used the code you said, filling in the username etc. and still get a database connection error.

TheDefender

You need to also supply the password setup for the connection. So, where you define the username and host, you also need to supply the PW.

$db_pass = "YourConnectionPassword";

Then, change this line:

@ $db = mysql_connect($hostname,$user);

to this:

@ $db = mysql_connect($hostname,$user,$db_pass);

Also, I recommend setting the dbname, host, username, password, etc in a separate include config file stored somewhere outside of the root directory.

hunkyjack

There is currently no password set because i have not set anything yet,

chyan

i've change little of ur code

<? 
$database="member"; // you're using member right? so fill it member 
$hostname="localhost"; //you can using localhost here 
$user="root"; // since you havent edit your mysql instalation, you can using root here 

$username = $HTTP_POST_VARS[ "username"];  

$password = $HTTP_POST_VARS[ "password"];  

if ($username=="" || $password=="")  

{  

echo "USERNAME/PASSWORD ERROR!"; 
exit;  

}  

//connect to database
if (!$db=mysql_connect($hostname,$user))
{
echo "Database connection Error";
exit;
}

// select your database
mysql_select_db($database,$db);
$query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";  

if (!$result=mysql_query($query,$db))  

{  

echo  "USERNAME/PASSWORD ERROR!"; 
exit;  

}

$inf = mysql_fetch_array($result);  

session_start();  

session_unset();  

$username2 = $inf["username"];  

$permissions = $inf[ "permissions"];  

?>

hunkyjack

I no longer get a database connection error, now I'm told that the username and password is correct whatever I enter (so long as both fields are filled). Any ideas why?
Thanks

Never mind. I found the problem. I've just changed

if (!$result=mysql_query($query,$db))

$result = mysql_query ($query,$db);
if (!mysql_num_rows ($result))

and it now works fine. Thanks for all the help.