password encryption

[audiomove]

I've copied the entire code of the file in case its a problem with something else.

The problem i think it is, is with the SQL select statement. But may be wrong.

<?php
require('../config.php');
require('../smarty-config.php');
require('../smarty.php');

session_start();
//print "Username: {$POST['txtUsername']}<br />";
//print "Password: {$POST['Password']}<br />";

$result = mysql_query("Select loginName FROM Admin_Member WHERE loginName='$POST[txtUsername]' AND password=password('$POST[txtPassword]')");
$numrows = mysql_num_rows($result);

$username = $POST['txtUsername'];
$password = $POST['txtPassword'];

// Validation
if(isset($username) && $username != "") {
if(isset($password) && $password != "") {
if ($numrows == 1) {
$SESSION['auth']="yes";
$SESSION['username'] = $username;
//print "Success, Please Wait";
//print "Redirecting....";
$smarty->display('admin_panel/admin_panel_index.tpl');
} else {
print "Unsuccessful login";
}
} else {
print "Please enter a password into the required field</br />";
}
} else {
print "Please enter a username into the required field</br />";
}
mysql_close();
?>

The problem is that when i try to login i keep getting login unsucsessful. It works on my development machine, php5, apache2, etc. But when i upload the entire code and exact database with all the insert statements I keep getting an unsuccessful login. I've had a few problems before when putting code on the host because its an older version of php (version 4.4.2)

Can anyone see why its failing to login using this script?

[laserlight]

You really need to structure the control flow much better:

<?php
require '../config.php';
require '../smarty-config.php';
require '../smarty.php';

session_start();

if (isset($_POST['txtUsername'], $_POST['txtPassword'])) {
	// assume magic_quotes_gpc is off
	$username = mysql_real_escape_string($_POST['txtUsername']);
	$password = mysql_real_escape_string($_POST['txtPassword']);

$query = "SELECT COUNT(loginName) FROM Admin_Member
	WHERE loginName='$username' AND `password`=PASSWORD('$password')";
if ($result = mysql_query($query)) {
	if (mysql_result($result, 0) == 1) {
		$_SESSION['auth'] = "yes";
		$_SESSION['username'] = $username;
		$smarty->display('admin_panel/admin_panel_index.tpl');
	} else {
		echo 'Unsuccessful login';
	}
} else {
	echo 'Database error';
}
} else {
	echo 'Please enter a username/password into the required field';
}
?>

[audiomove]

thanks for the reply, im still getting unsuccessfull login on my host machine but it still works on my development machine.

[laserlight]

Check your data. Are you sure that the row exists on your host machine, and corresponds to the input used to test? In particular, are the passwords stored the same? My suggestion is to use a SHA1 hash generated from PHP instead of PASSWORD in MySQL.

[stewartship]

just to say agree with laserlight SHA1 is a better option

[audiomove]

SHA worked, and i was originally gonna use that :-)
Thanks very much for the help.