Whats wrong with this SQL snytax

rjive

What is wrong with this code. I keep getting this error:

You have an error in your SQL syntax near '('password')' at line 1

//create and issue the query
$sql = "select username, user_password from phpbb_users  where username = '$_POST[username]' AND user_password = user_password('$_POST[user_password]')";
$result = mysql_query($sql,$conn) or die(mysql_error());

//get the number of rows in the result set; should be 1 if a match
if (mysql_num_rows($result) == 1) {

please help, I've going after this for hours. Any help you can provide would be great.

planetsim

Lets change the query formatting to be more informative

//create and issue the query
$sql = "select username, user_password 
       from phpbb_users  

       where username = '".$_POST['username']."'
       AND user_password = '".user_password($_POST['user_password'])."'
       ";
$result = mysql_query($sql,$conn) or die(mysql_error()."<br />".$sql);

//get the number of rows in the result set; should be 1 if a match
if (mysql_num_rows($result) == 1) {

Added the $sql into the die statement mainly to show you how the SQL Looks and to be able to run in PHPMyAdmin to test

rjive

How do I run the test in myadmin?

I added the code into my page, but it does not seem to change anything, however, I didn't get the error message, but now just a blank page. I've been going crazy trying to figure this out. Thanks for the help

rjive

I threw the code into myadmin and this is the error message I received. If you cannot tell, I am new at this.

Error

SQL-query :

/ CREATE AND issue the query$sql = "select username, user_password from phpbb_users where username = '".$_POST[ 'username']. "' AND user_password = '".user_password(

$_POST[ 'user_password']
). "' "

MySQL said:

You have an error in your SQL syntax near '//create and issue the query
$sql = "select username, user_password
f' at line 1