i feel stupid asking this....login related

peanutgallery83

Wow, this is the mother of all brain farts I think. The following login authentication script is not working. I have no idea why I can't see the problem....I'm just drawing a blank.

Please help! Sorry for the trouble.

Landis

//build and issue query
$sql = "
SELECT id, f_name, l_name, trim(concat(f_name, ' ', l_name)) as referee_name, address_1, address_2, city, state, zip, prim_phone, 
alt_phone, email, class
FROM $table_name 
WHERE username = '" .$_POST['username'] . "' 
AND password = (password('" . $_POST['password']. "'));"; 

$result = @mysql_query($sql,$connection)or die(mysql_error());

jonno946

what error do you get?

try echoing out your sql query and running it in phpmyadmin or manually through mysql.

i can see a few problems with your code but i'm unsure if they could be causing the problem without knowing what the errors your getting are.

Jonno

tsinka

Hi,

how does the query look like if you print it with

echo $sql;

Thomas

peanutgallery83

Hi. I'm getting a t_string error.

It's being caused by something in the WHERE .... AND.... area. If I replace that with WHERE username = $username1

(where $username1 is a stored variable) then it will work...so the error is being caused by the $_POST stuff.

By the way, the $_POST is coming from a form on a preceeding page.

Again, it all worked fine until I started using the $_POST part, so that's where I'm having a problem

tsinka

Please post the script as attachment. How does the exact error message look like ?

Thomas

buddhist

Originally posted by peanutgallery83
Wow, this is the mother of all brain farts I think. The following login authentication script is not working. I have no idea why I can't see the problem....I'm just drawing a blank.

Please help! Sorry for the trouble.

Landis
WHERE username = " " .'$_POST[username]' . '
AND password = (password('" . $_POST['password']. "'));"; 

$result = @mysql_query($sql,$connection)or die(mysql_error());
[/B]

I'm not sure if I'm right but, I thought you need to use single quotes on the outside of the POST variable like this : '$_POST[username]'

So in other words, username itself shouldn't have single quotes on it. The same for the POST variable of password. *Note this is only true when injecting POST variables into a sql command, and not outside of SQL statements.

WHERE username = '$_POST[username]' 
AND password = '$_POST[password]')"; 

$result = @mysql_query($sql,$connection)or die(mysql_error());

Is what I think it should read. But I'mma newbie so... take it for face value.