what am i missing. PHP and MYSQL

[severndigital]

I've been playing with this all day, can someone shed some light on why it's not working.

basically i want to get info from the data table and put it on the page.

my username and password are being passed to the script with the sessions command.

here's my query with a num_row:

$info_sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");

$get_info = mysql_num_rows($info_sql);

so then i run an IF:

if ($get_info !== 1){
	echo'<BR><BR><font color="RED"><strong>There was an error processing your request. Please go back and try again.</strong></font>';
	exit();
	} else {

while ($row = mysql_fetch_array($info_sql)) {
$id = $row['id'];
$firstname = $row['firstname'];
$lastname = $row['lastname'];
$title = $row['title'];
$email = $row['email'];
$phone = $row['phone'];
$cellph = $row['row'];
$address1 = $row['address1'];
$address2 = $row['address2'];
$city = $row['city'];
$state = $row['state'];
$zip = $row['zip'];
$website = $row['website'];
}
}
	?>

My file keeps generating the error from the IF statment, it's not getting the results from mysql.

here is the complete code:

<?php
$username = $_SESSION['username'];
$password = $_SESSION['password']; 

//include '../config.inc.php';
//get the info for the form.
$info_sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");

$get_info = mysql_num_rows($info_sql);

if ($get_info !== 1){
	echo'<BR><BR><font color="RED"><strong>There was an error processing your request. Please go back and try again.</strong></font>';
	exit();
	} else {

while ($row = mysql_fetch_array($info_sql)) {
$id = $row['id'];
$firstname = $row['firstname'];
$lastname = $row['lastname'];
$title = $row['title'];
$email = $row['email'];
$phone = $row['phone'];
$cellph = $row['row'];
$address1 = $row['address1'];
$address2 = $row['address2'];
$city = $row['city'];
$state = $row['state'];
$zip = $row['zip'];
$website = $row['website'];
}
}
	?>

Can anyone see anything wrong??

thanks in advance,

chris

[matt72]

A couple of quick debugging things to try:

$info_sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'") or die(mysql_error()); //Is the query actually working

$get_info = mysql_num_rows($info_sql);

echo "Val: " . $get_info; //Check the value of $get_info

See if that turns up anything.

[bpat1434]

My guess would be this:
1.) You "include" the connection, but you commented the line out so it's not included 🙁
2.) You don't limit your query to 1 row, so if you get 2 or more rows, it will fail 🙁
3.) You don't ever explicitly connect to the mySQL server 🙁

Also, there's plenty of room for hacking without validating your input.... 🙁