[RESOLVED] mysql_query question, please help

[fascom746]

Hello;

I have a table

Table structure for table `sbbleads_members`
#

DROP TABLE IF EXISTS `sbbleads_members`;
CREATE TABLE `sbbleads_members` (
  `sb_id` bigint(20) NOT NULL auto_increment,
  `sb_username` varchar(255) default NULL,
  `sb_password` varchar(255) default NULL,
  `sb_firstname` varchar(255) default NULL,
  `sb_lastname` varchar(255) default NULL,
  `sb_email` varchar(255) default NULL,
  `sb_street` varchar(255) default NULL,
  `sb_city` varchar(255) default NULL,
  `sb_state` varchar(255) default NULL,
  `sb_zip` varchar(255) default NULL,
  `sb_country` bigint(20) default NULL,
  `sb_phone` varchar(255) default NULL,
  `sb_fax` varchar(255) default NULL,
  `sb_mobile` varchar(255) default NULL,
  `tempdate` timestamp(14) NOT NULL,
  `sb_ondate` timestamp(14) NOT NULL,
  `sb_expiry_date` timestamp(14) NOT NULL,
  `sb_memtype` bigint(20) default NULL,
  `sb_lastlogin` timestamp(14) NOT NULL,
  `sb_suspended` varchar(255) default NULL,
  PRIMARY KEY  (`sb_id`)
) TYPE=MyISAM;

#
# Dumping data for table `sbbleads_members`
#

INSERT INTO `sbbleads_members` (`sb_id`, `sb_username`, `sb_password`, `sb_firstname`, `sb_lastname`, `sb_email`, `sb_street`, `sb_city`, `sb_state`, `sb_zip`, `sb_country`, `sb_phone`, `sb_fax`, `sb_mobile`, `tempdate`, `sb_ondate`, `sb_expiry_date`, `sb_memtype`, `sb_lastlogin`, `sb_suspended`)

And I want to write a mysql query to fetch usernmae and password and I am writing it in this fashion:

function BBGetUser($username, $password) {

  BBConnect();

  $result = mysql_query("SELECT * FROM sbbleads_members WHERE sb_username = '$username'");
  $userdata = mysql_fetch_array($result);

  ($userdata[sb_password] == $password) ? $pwok = 1 : $pwok = 0;
  ($userdata[sb_username] == $username) ? $pwok = 1 : $pwok = 0;
  return $pwok;


}

But could not get it right 100%. please give me some suggestions to fetch usernmae and password from the table.

Thanks

[snoopgreen]

While ($userdata = mysql_fetch_array($result)) {

echo( $userdata["sb_password"] );

something along these lines
may help you will have to add some more snipets to the script

this will take the place of

$userdata = mysql_fetch_array($result);

  ($userdata[sb_password] == $password)

dont know if this is what u meant but it will allow for you to output the password to your screen

[fascom746]

Actually, fetching username causing problems

[bpat1434]

Wow... so you want the username and password to show up?

<?php

function BBGetUser($username, $password) {

  BBConnect();

  $query = "SELECT sb_username, sb_password FROM sbbleads_members WHERE sb_username='$username' LIMIT 1";

  $result = @mysql_query($query);
  if(@mysql_num_rows($result)>0) // If we've found the user
  {
    $userdata = mysql_fetch_array($result);

$pwok = ($userdata['sb_password'] == $password) ? 1 : 0;
// $pwok = ($userdata[sb_username] == $username) ? 1 : 0;
  }
  else // Username not found in the database
  {
    $pwok = 0;
  }
  return $pwok;
}

Now, the reason we don't need to double check the username is because if the username is used in the query, and not found, the query will fail, which our "if(@mysql_num_rows($result)>0)" checks.

Your ternary operation was incorrect. I fixed it. I hope this makes sense. Any questions, just ask!!

~Brett

[fascom746]

Ok this works, Now I am checking the system to see whether every thing working fine. I will post any further issues if found.

[fascom746]

I have found a problem. Only system verifying the username and let the user in without verifying the password. I mean pass is not verified so anyone can get access by knowing only the username. please help me in fixing it

[bpat1434]

And what does your code look like? How is it being implemented?

[Roger_Ramjet]

$query = "SELECT sb_username, sb_password FROM sbbleads_members WHERE sb_username='$username' AND sb_password='$password' LIMIT 1";

[fascom746]

Actually I am writing a integration module between a cms and a classified type php script. This requires writing a bbwrapper.php file for cms. and I have wrritten it in this way

http://www.geocities.com/fascom746/bbwrapper6.txt

The cms has an ability to integrate virtually in any system just by writing the bbwrapper.php file. the default cms package include many systems integration module including phpbb, v bultin, ibp etc but it does no include the system I want to integrate so I am writing bbwrapper.php file. For sample purpose I am including here the user table of phpbb and its corresponding bbwrapper that works perfectly with phpbb.

User table of phpbb

CREATE TABLE `phpbb_users` (
  `user_id` mediumint(8) NOT NULL default '0',
  `user_active` tinyint(1) default '1',
  `username` varchar(25) NOT NULL default '',
  `user_password` varchar(32) NOT NULL default '',
  `user_session_time` int(11) NOT NULL default '0',
  `user_session_page` smallint(5) NOT NULL default '0',
  `user_lastvisit` int(11) NOT NULL default '0',
  `user_regdate` int(11) NOT NULL default '0',
  `user_level` tinyint(4) default '0',
  `user_posts` mediumint(8) unsigned NOT NULL default '0',
  `user_timezone` decimal(5,2) NOT NULL default '0.00',
  `user_style` tinyint(4) default NULL,
  `user_lang` varchar(255) default NULL,
  `user_dateformat` varchar(14) NOT NULL default 'd M Y H:i',
  `user_new_privmsg` smallint(5) unsigned NOT NULL default '0',
  `user_unread_privmsg` smallint(5) unsigned NOT NULL default '0',
  `user_last_privmsg` int(11) NOT NULL default '0',
  `user_emailtime` int(11) default NULL,
  `user_viewemail` tinyint(1) default NULL,
  `user_attachsig` tinyint(1) default NULL,
  `user_allowhtml` tinyint(1) default '1',
  `user_allowbbcode` tinyint(1) default '1',
  `user_allowsmile` tinyint(1) default '1',
  `user_allowavatar` tinyint(1) NOT NULL default '1',
  `user_allow_pm` tinyint(1) NOT NULL default '1',
  `user_allow_viewonline` tinyint(1) NOT NULL default '1',
  `user_notify` tinyint(1) NOT NULL default '1',
  `user_notify_pm` tinyint(1) NOT NULL default '0',
  `user_popup_pm` tinyint(1) NOT NULL default '0',
  `user_rank` int(11) default '0',
  `user_avatar` varchar(100) default NULL,
  `user_avatar_type` tinyint(4) NOT NULL default '0',
  `user_email` varchar(255) default NULL,
  `user_icq` varchar(15) default NULL,
  `user_website` varchar(100) default NULL,
  `user_from` varchar(100) default NULL,
  `user_sig` text,
  `user_sig_bbcode_uid` varchar(10) default NULL,
  `user_aim` varchar(255) default NULL,
  `user_yim` varchar(255) default NULL,
  `user_msnm` varchar(255) default NULL,
  `user_occ` varchar(100) default NULL,
  `user_interests` varchar(255) default NULL,
  `user_actkey` varchar(32) default NULL,
  `user_newpasswd` varchar(32) default NULL,
  PRIMARY KEY  (`user_id`),
  KEY `user_session_time` (`user_session_time`)
) TYPE=MyISAM;

-- 
-- Dumping data for table `phpbb_users`
-- 

INSERT INTO `phpbb_users` VALUES (-1, 0, 'Anonymous', '', 0, 0, 0, 1134921027, 0, 0, 0.00, NULL, '', '', 0, 0, 0, NULL, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, NULL, '', 0, '', '', '', '', '', NULL, '', '', '', '', '', '', '');
INSERT INTO `phpbb_users` VALUES (2, 1, 'admin', 'ded239a4b5a2375487457a3a06db958a', 1136565675, 0, 1136191382, 1134921027, 1, 8, 0.00, 1, 'english', 'd M Y h:i a', 0, 0, 1135200466, NULL, 1, 0, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, '', 0, '[e-mail]', '', '', '', '', '', '', '', '', '', '', '', '');

its bbwrapper.php file at

http://www.geocities.com/fascom746/bbwrapper.txt

[Roger_Ramjet]

So have you amended the query to select only if BOTH username AND password match? 'cos that was the problem: you were just selecting on username and ignoring the password.

[fascom746]

All problems relating to fetching username and password are now fixed. Actually the login.php file included in the cms was using md5 encryption for password. But as you can see in the table sbbleads_members the pass is not encrypted. I just removed md5 encryption in login.php file for pass.

The code supplied by bpat1434 is correct and works fine.