[RESOLVED] Bad SQL Query return

umrguy

Basically, I'm looking to set two different types of SESSION variables depending on if the user should have extra permissions or not. However, I'm having issues getting it set up correctly. I've tried a number of different things, but just cant seem to figure out what exactly is going on. The code that is having problems looks like this.

session_start();
$query = "SELECT phpbb_users.user_id AS id FROM phpbb_users WHERE phpbb_users.username = '$u' AND phpbb_users.user_password = MD5('$p')";
$result = @($query);
$row = mysql_fetch_array ($result, MYSQL_NUM);
if (mysql_num_rows($row) > 0)
{
if ($row[0] == 2 OR $row[0] == 3 OR $row[0] == 4 OR $row[0] == 5)
{
$SESSION['dblogin'] = 2;
}
elseif ($row[0] > 5)
{
$SESSION['dblogin'] = 1;
}
}
else
{
$errors[] = 'Username and password did not match any existing records.';
}

The username and password are being passed correctly to the query, and the sql query is retuning the correct results if I run it straight in the database. However, I can't get any matches to be made. Please help me out. Thanks.

coreyp_1

Replace

 if (mysql_num_rows($row) > 0)

with

 if (mysql_num_rows($result) > 0)

Of course, you could just restructure the entire code block to something like this:

session_start();
$query = "SELECT phpbb_users.user_id AS id
  FROM phpbb_users
  WHERE phpbb_users.username = '$u' AND phpbb_users.user_password = MD5('$p')";
$result = @mysql_query($query);
if ($row = mysql_fetch_array ($result, MYSQL_NUM)) {
  if (($row[0] >= 2) && ($row[0] <= 5)) {
    $_SESSION['dblogin'] = 2;
  } elseif ($row[0] > 5) {
    $_SESSION['dblogin'] = 1;
  }
} else {
  $errors[] = 'Username and password did not match any existing records.';
}

umrguy

Thanks, the fixed the no result problem. However, now I'm having an issue of the session variable always being set to 2, no matter who logs in. The row[0] is equal to 6, and the session variable is still set to 2.

Weedpacket

I can't see straight off why that would be the case, but regardless: it would probably be simpler to have an additional field in the users table to indicate whether that user has administrator privileges or not. Then check the value of that field instead of trying to use the user_id for both tasks. This would avoid the problem that you'd have if a user had an id of 0 or 1. (There's also the possibility that $_SESSION['dblogin'] would be set to 2 at some point in the session and then still be 2 if an incorrect login attempt was made later during the same session.)

Incidentally, there's little point selecing a field "AS id" if you throw away all the column names when you fetch the array from the result set 🙂

umrguy

Well, I thought of that, but I'm using two different databases. One is a PHPBB database, and the other is a custom db that I'm working on creating the php pages to interface with the custom one. All of the users from the php bb that should have admin rights belong to one group in the boards. I tried using a return based on a JOIN between the users and users_groups table, but even when the SQL query returned nothing, I couldnt get the result to recognize the empty query and instead, it said a result was returned. I'm going to try going back to that route with parts of this new solution, but I thought this way could get around the problem I was having.

The results showing up on the page, using the above code and echo statements, show that the session variable is 2, and the id is 6, so I'm completely stumped still.

Yes, I understand the no point in the select field, but I have been messing with that query and result a lot trying to figure out the answer🙂

coreyp_1

Are you checking the session variable before and after the code? Normally this would be redundant, but when you have something that strange going on, who knows what you may discover!

umrguy

The page calls itself after log in, so I have a few spots where I'm pulling the Session Var. On the first load, it shows up as empty, after suppling a login and password, it shows up as 2. I haven't put any display in the code after the call, but I'll work on that tomorrow. Thanks for the help and I'll just keep attempting to test things.

umrguy

$query = "SELECT phpbb_users.user_id AS id FROM phpbb_users WHERE phpbb_users.username = '$u' AND phpbb_users.user_password = MD5('$p')";
			$result = @mysql_query($query);
			if ($row = mysql_fetch_array ($result, MYSQL_NUM))
			{
				if ($row[0] >1 && $row[0] <6)
				{
					$bad = "In Admin Loop";
					$_SESSION['dblogin'] = 1;
				}
				elseif ($row[0] > 5)
				{
					$_SESSION['dblogin'] = 3;
					$bad = "In User Loop";
				}
                      }

This is the code that I'm currently using. The code is going into the second loop correctly. However, the session variable is always being displayed with an echo statement as being set to 2. This would be the first session variable, ever, that I set for dblogin. Note that this is not the variable I set today, but has been there since I started working on the page. So, it seems to me that the session variable is not truely being destroyed and recreated with my logout script. My logout code is:

        session_start();
	unset($_SESSION['dblogin']);
	$_SESSION = array();
	session_destroy();
	 header("location:loginpage.php");
	 exit;

I know part of that is redundant, but I'm trying everything to figure this out.
Is there some other code that would force a new session ID at the login page or some other way of completely destorying and then resetting session variables that I'm missing? Thanks.

coreyp_1

Well, I'm stumped! I would probably do a lot of experimenting to see what I could figure out.

What would be printed out before and after the code in question using this:
echo '<pre>'.print_r($_SESSION, true).'</pre>';

you haven't already called session_write_close(), have you?

umrguy

So, I got ahold of my hosting company and had them take a look at it. I feel like a moron...I had missed a "==" in one of my if statements for the dynamic display. It's fixed now.