[RESOLVED] login script problems

Glader

Hi, I am having some problems with the simplest farking login page in the world. I'm building it to get the basics right, to be able to actually understand the proccess. Anyway, here's the code.

<?php



$host = "localhost";
$user = "xxxxxxxx";
$pass = "xxxxxxxx";
$db = "infinitk_phpbb1";



$connection = mysql_connect($host, $user, $pass) or die ("Could not connect to database");

// selects the database

mysql_select_db($db) or die("could not select database");




$result = mysql_query("SELECT user_password FROM phpbb_users WHERE username = $_POST[user]");


$md5 = md5($_POST['pass']);

if ($result == ($md5)) {


header('Location: success.php');

}


else 
echo "password output: $md5<br>";
echo "username input: $_POST[user]<br>";
echo "username output: $result<br>";


?>

the username and password are cencored (yes, they are correct and that is not the issue)

This script recieves the user and pass information from login.html which is a simple login page with 2 fields. Anyway, the problem I'm having is that I do not get redirected to success.php cause instead of an actual username output I keep getting Resource ID#2

You might have seen this problem before, but since the search-engine on this site seems to be down I have no choice but to start a new thread.

Many thanks for your time, I'm thankful for any help

rincewind456

You need to use [man]mysql_fetch_array/man or [man]mysql_fetch_row/man or similar to access what you have retrieved from the DB query.

Glader

Thank you very much for the help, I was wondering if something like it was the problem but I couldn't figure out what to do about it😃
Works fine now and redirects me to success.php.

Here's the code btw if it can be put to any use.

<?php



$host = "localhost";
$user = "xxxxxx";
$pass = "xxxxxx";
$db = "infinitk_phpbb1";



$connection = mysql_connect($host, $user, $pass) or die ("Could not connect to database");

// selects the database

mysql_select_db($db) or die("could not select database");



$user="$_POST[user]";

$result = mysql_query("SELECT user_password FROM phpbb_users WHERE username = '" . $user . "'");


$row = mysql_fetch_array($result, MYSQL_NUM);



$md5 = md5($_POST['pass']);

if ($row[0] == ($md5)) {


header('Location: success.php');
echo "success";

}


else 

echo "password output: $md5<br>";
echo "username input: $_POST[user]<br>";
echo "username output: $row[0]";



?>

suntra

Please replace this line...

$result = mysql_query("SELECT user_password FROM phpbb_users WHERE username = '" . $user . "'");

with this one :

$result = mysql_query("SELECT user_password FROM phpbb_users WHERE username = '" . mysql_real_escape_string($user) . "'");

This will prevent SQL injection 😉

Glader

Thx for the help, making the script secure is always good 😛
Gonna read up abit on trimming posts and similar stuff as well to make it better.