login script help

[blckspder]

Hello,
I cant get this script to work, for some reason it doesnt seem to be pulling from the MySQL table....

<?php

include('config.php');
include('opendb.php');

$usname = $_POST['usname'];
$pwname = $_POST['pwname'];
$userror = NULL;
$pwerror = NULL;

if(isset($_POST['submit'])) {

$chkus = "SELECT usname FROM geologin";
$loginus = mysql_query($chkus);

			 if($usname == $loginus){
			  $chkpw = "SELECT psname FROM geologin";
				$loginpw = mysql_query($chkpw);
			  				 if($pwname == $loginpw) {
								 header("Location:http://pennyspder.sousaink.com/geosubmit.php");
								 } else {
								 	 			$pwerror = "Invalid Password";
												}
			} else {
						 $userror = "Invalid Username";
						 }

}

?>

Thanks for the help

[frost110]

mysql_query only returns a resource try this out:

<?php

include('config.php');
include('opendb.php');

$usname = $_POST['usname'];
$pwname = $_POST['pwname'];
$userror = NULL;
$pwerror = NULL;

if(isset($_POST['submit'])) {
	$chkus = "SELECT usname, psname FROM geologin WHERE usname = '".$_POST['usname']."'";
	$loginData = mysql_query($chkus);
	$loginData = mysql_fetch_assoc($loginData);

$loginpw = $loginData['psname'];
$loginus = $loginData['usname'];

if($usname == $loginus){
	if($pwname == $loginpw) {
        header("Location:http://pennyspder.sousaink.com/geosubmit.php");
    } else {
        $pwerror = "Invalid Password";
    } 
  }else {
        $userror = "Invalid Username";
  }

}

Also, you should really only pull data from mysql that you need. Not every single row. IE:

Change:
$chkus = "SELECT usname FROM geologin";

To:
$chkus = "SELECT usname, psname FROM geologin WHERE usname = '" . $_POST['usname'] . "'";

--FrosT

[blckspder]

cool Ill try that and let you know how it goes! Thanks! 🙂

[blckspder]

it worked! thanks a bunch... I had totally forgotten about mysql_fetch_assoc ... duh

[blckspder]

Here is another question for you... how would you add sessions to the login script? and will that fix the problem of someone being able to just go to the page im redirecting them too rather then logging in? Ive been reading up on sessions but Im not sure I understand how the page the user is redirecting knows that person has been logged in? there must be something there to validate the session right? or do you have to go to the database again?