database connection and function

pixelsoul

Hey, well the n00b area is the right place for me heh 😉

I was just having some fun in making my own DB connection to MySql with an user authentication and I think I am kind of getting the idea of how to do this but there seems to be something wrong in my syntax and was wondering if some of you could look at it and tell me what I am doing wrong or even the stuff I am doing right if there is a better way to do it.

<?php require_once('./connections/gateway.php'); ?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>User Login</title>

</head>

<body>

<?php function login_form(){
  ?>

    <form action="index.php" method="POST">
    <h3>System Login</h3> 
    User Name: <input type="text" name="user_name"><br>
    Password : <input type="password" name="password"><br>
    <input type="submit" name="submit" value="Login"><br> 
    </form>

<?php
}
if (!$gateway = mysql_connect($hostname_gateway, $username_gateway, $password_gateway)){
	  echo ("Error connecting to the database");
	}else{

$sql = "SELECT * FROM users WHERE username";
$result = mysql_query($sql);
$row_count = mysql_num_rows($result);
}        

if($row_count == 0){

  echo "<h3>Unkown username</h3>";
  login_form();

}
else $row = mysql_fetch_array($result);

  if($password != $row["password"]){

    echo "<h3>Incorrect password</h3>";
    login_form();
}


?>

</body>
</html>

The error I am currently getting now is:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/u3/mrlogo_main/html/test/index.php on line 31

Thanks for any help, I appreciate it.

cdwhalley_com

Corrected code:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>

<title>User Login</title>

</head>

<body>

<?php 
function login_form(){//function that when called outputs the login form
echo "<form action=\"index.php\" method=\"POST\"><h3>System Login</h3>User Name: <input type=\"text\" name=\"user_name\"><br>Password : <input type=\"password\" name=\"password\"><br><input type=\"submit\" name=\"submit\" value=\"Login\"><br></form>";
}
if (isset($_POST['username'])) {

  $inputusername=$_POST['username'];
  $inputpassword=$_POST['password'];

  $host="";//mysql host
  $user="";//mysql username
  $pass="";//mysql password for the username
  $database="";//name of the database
  $connection=mysql_connect($host, $user, $pass) or die(mysql_error());//connect to db
  $db=mysql_select_db($database, $connection) or die(mysql_error());//select database
  $sql = "SELECT password FROM users WHERE username='$inputusername'";//the query
  $result = mysql_query($sql) or die("Incorrect username - <a href=\"index.php\">try again</a>");//run the query, if it can't find a user output error message and link to try login again
  $row=mysql_fetch_array($result);//get an array from the row
  list($dbpassword)=$row;//get $dbpassword out of the array
  if ($dbpassword == $inputpassword) {//if the password they entered is correct for that username
        //Logged in
  } else {
        echo "Incorrect password<br/>";
        login_form();
  }
}  

?>

</body>
</html>

pixelsoul

Awsome,

Thanks for that and the commenting. It also shows me a cleaner way to do things.

Thanks!

pixelsoul

So I am a little confused. With the corrected code it currently has no errors outputted but also the page is completely blank. If I am correct in looking at it the user login should show on the page but for some reason it is not.

Is the function not being called properly for it to show?

Thanks.

Houdini

The form has an action of index.php so what is your index.php page because that is where the script is sending it to after pressing submit.

pixelsoul

lol, well it is currently (temporarly) is my index page. But even if that was the case I should still be able to see the login form I would imagine? I guess I should have the form set up to go to a protected page or something.

You see I am not even given the chance to login, it just does not show.

robin_percy

That's because login_form() is only called when a username is posted. Add this else clause after the closing bracket of the main IF block.

else
{
login_form();
}