if the else

alex57

Hey im trying to create a simple login sysytem but the 'else' part of the if then else statement isnt firing and i cannot work out why. Im pretty sure the curly brackets are correct. Thanks
My code is listed below....

<html>
<body>
<?php

mysql_connect("localhost", "root", "dinosaur") or die(mysql_error());
echo "Connected to MySQL<br />";
mysql_select_db("info") or die(mysql_error());

$username = $POST['username'];
$password = $POST['password'];

$result = mysql_query("SELECT * FROM users WHERE username = '$username' && password='$password'");

while($row = mysql_fetch_array($result))
{
if(($row['username'] == $username) && ($row['password'] == $password))
{
echo $row['password'].' you are logged in';
session_start();
session_register('username');
}
else
{
echo "you are not logged in";
print "<script>";
print " self.location='reg.html'";
print "</script>";
}
}

?>
</body>
</html>

Installer

The "else" part will execute, as this stripped-down test shows:

$username = 'user';
$row['username'] = $username;
$password = 'password';
$row['password'] = 'pw';
if(($row['username'] == $username) && ($row['password'] == $password)) {
    echo $row['password'] . ' you are logged in';
} else {
    echo "you are not logged in";
}

BTW:

Your session won't start, as you probably already know from the warning messages.

Why are you using a "while" loop to log in one user?

Rodney_H_

two additional things:

1) I would encrypt your passwords using one of the PHP functions

2) I would not run the query with the user supplied input without cleaning it, or making it safe for your query

Thanks.

ClarkF1

You are also echoing the password.........not a good idea.