Code Error or MySQL Problem?

[goosehunter]

I'm working through "PHP and MySQL Web Development" by Welling and Thomson. The password w/db lookup example provided on the CD is not working. Is the code incorrect or is communication to the MySQL database not working properly?

---

<?php
}
else
{
// connect to mysql
$mysql = mysql_connect( 'localhost', 'webauth', 'webauth' );
if(!$mysql)
{
echo 'Cannot connect to database.';
exit;
}
// select the appropriate database
$mysql = mysql_select_db( 'auth' );
if(!$mysql)
{
echo 'Cannot select database.';
exit;
}

// query the database to see if there is a record which matches
$query = "select count(*) from auth where
          name = '$name' and
          pass = '$password'";

$result = mysql_query($query);
if(!$result)
{
  echo 'Cannot run query.';
  exit;
}

$count = mysql_result( $result, 0, 0 );
if ( $count > 0 )
{
  // visitor's name and password combination are correct
  echo '<h1>Here it is!</h1>';
  echo 'I bet you are glad you can see this secret page.';
}
else
{
  // visitor's name and password combination are not correct
  echo '<h1>Go Away!</h1>';
  echo 'You are not authorized to view this resource.';
}

}
?>

---

Even with a correct name and password combination I get the "You are not authorized . . ." I have done an echo for $count and the value is 0. I have used phpMyAdmin to perform a query and can indeed match a name and password and select a record.

[devinemke]

your book's sample code expects register_globals to be ON in your php.ini and i suspect your have it OFF. read up on Using Register Globals.

[Drakla]

I'll warn you now, that book is full of errors - and not only errors but downright illogical code in the only useful section, which is the bit about web services.

I was given is as a present and the only reason it's not in a charity shop is because I wrote a load of filth in it.

I'd recommend doing a load of other tutorials and just reading that in bed to get ideas.

[goosehunter]

Yes, I'm aware that register_globals must be on for some password examples in this book but none were mentioned for this particular segment. My register_globals were indeed OFF.

You are right. After turning it ON, things work properly. But since this is a security issue, how do I implement the password check without register_globals ON?