Can someone check this code?

rjive

I am having trouble with this code. I've tried a few different things. I have put in an echo to see where the code stops, but when I try and the script, it is a blank page.

I am trying to have a section where my members log in and it uses the same database as phpbb for the users. I removed the user/password for my server for security of course. Any help anyone can provide would be great. Thanks

Here is the code:

<?php
//check for required fields from the form
if ((!$_POST[username]=="") and (!$_POST[user_password]=="")) {
    header("Location: listing23.7.php");
    exit;
	echo "point1";

//connect to server and select database
$conn = mysql_connect("localhost", "XXXXXX", "XXXXXXXX") or die(mysql_error());
mysql_select_db("db_new1",$conn)  or die(mysql_error());
echo "point2";

//create and issue the query 
$sql = "select username, user_password from phpbb_users  where username = '$_POST[username]' AND user_password = password('$_POST[user_password]')";
$result = mysql_query($sql,$conn) or die(mysql_error());
echo"point3";
//get the number of rows in the result set; should be 1 if a match 
if (mysql_num_rows($result) == 1) {
echo"point4";
   //if authorized, get the values of username
   $username = mysql_result($result, 0, 'username');
   echo"point5";
   //set authorization cookie
   setcookie("auth", "1", 0, "/", "goldcountrymini.com", 0);
echo"point6";
   //prepare message for printing, and user menu
   $msg = "<P>$username is authorized!</p>";
   $msg .= "<P>Authorized Users' Menu:";
   $msg .= "<ul><li><a href=http://www.goldcountrymini.com>secret page</a></ul>";
echo"point7";
?>
<HTML>
<HEAD>
<TITLE>Listing 23.8</TITLE>
</HEAD>
<BODY>
<? print "$msg"; ?>
</BODY>
</HTML>

edcellgavin

try echoing the post variables at the start of your code to check if you have satisfied your 'if' statement coz i can't find the closing '}' for your condition statements.

rjive

ok., you're right, I fixed the the missing "}". Now I get to point three, then my code stops. Any suggestions?

leatherback

Hi,

that means that yur query did not return 1 result.

I still have the feeling, (as I posted 10+ posts ago) that your password function might be the problem. But if you cannot explain what it does, and why it is there?

You could now place a line directly after the querystatement;

echo "select username, user_password from phpbb_users where username = '$POST[username]' AND user_password = password('$POST[user_password]')";

this will give you the query which was posted to MySQL, and you can check whether it is like you expect it to be.

Installer

Due to operator precedence, implicit type-casting, and the typeless equality operator, this construction

!$_POST[username]==""

will resolve to true if the user name has been filled in (thus triggering your location header), and false if it hasn't. I think you want it the other way around. This is the way to do it:

!$_POST['username'] != ""

And quote your array indexes. And turn on error reporting and display to shine a little more light on what's happening.

rjive

Originally posted by leatherback
Hi,

that means that yur query did not return 1 result.

I still have the feeling, (as I posted 10+ posts ago) that your password function might be the problem. But if you cannot explain what it does, and why it is there?

You could now place a line directly after the querystatement;

echo "select username, user_password from phpbb_users where username = '$POST[username]' AND user_password = password('$POST[user_password]')";

this will give you the query which was posted to MySQL, and you can check whether it is like you expect it to be.

J.

Ok, that worked like a charm. The syntax is correct now. I am losing the whole script at this:

//get the number of rows in the result set; should be 1 if a match 
if (mysql_num_rows($result) == 1) {
   //if authorized, get the values of username
   $username = mysql_result($result, 0, 'username');
   echo"point5";

Any thoughts on why this would be. I am new to this whole gig, but I thank everyone for the help! 😃

Wired1

Originally posted by rjive
Ok, that worked like a charm. The syntax is correct now. I am losing the whole script at this:
//get the number of rows in the result set; should be 1 if a match 
if (mysql_num_rows($result) == 1) {
   //if authorized, get the values of username
   $username = mysql_result($result, 0, 'username');
   echo"point5";
Any thoughts on why this would be. I am new to this whole gig, but I thank everyone for the help! 😃 [/B]

I don't see an escaping } for the if statement.