Login Script Problem

whobutsb

Alright I have this login script. Whenever I put in my username and password that I want to use it just gives me the same page like its refreshing and not running my echos. What am I missing?

<link href="/Beacon/New_Site/adminstyle.css" rel="stylesheet" type="text/css">
<title>New Beacon Admin Page</title>
<table width="center" cellspacing="1" cellpadding="1" class="boxborder" align="center">
		  <tr>
			<td class="text">Login Required</td>
		  </tr>
		</table>

	<form action="" method="post">
	<table width="center" cellspacing="1" cellpadding="1" class="boxborder" align="center">
	  <tr>
		<td class="text" align="center"><br/>
			Username: <input name="username" size="20" />
			Password: <input type="password" name="password" size="20" />
			<input type="submit" name="login" value="Log in" /><br /><br />
		</td>
	  </tr>
	</table>
	</form>

<?php
if (isset($POST_HTTP_VARS['login']))
{
	$sql = "SELECT user FROM login WHERE user = '$_POST[username]'";
	$result= mysql_query($sql) or die (mysql_error());
	$num = mysql_num_rows($result);
	if ($num == 1) //login was found
	{
		$sql = "SELECT user FROM login WHERE user = '$_POST[username]' AND password = '$_POST[password]'";
		$result2 = mysql_query($sql)
			or die (mysql_error());
		$num2= mysql_num_rows($result2);
		if (num2 > 0) // Password was correct
			{
				$_SESSION['auth']="yes";
				$loginname = $_POST['username'];
				$_SESSION['logname'] = $logname;
				$today = date("Y-m-d");
				echo "Success <br>";
				echo "<a href='/admin.php?caseid=home'>Admin Page</a>";
			}
		else
			{	
				echo "Wrong Username or Password";
			}
	}
}

Thanks for the help!

stolzyboy

is this posting to the same page? if so, at the very least put the action in the form tag to point to the page, either statically or with $_SERVER['PHP_SELF'];

also, your variables are wrong, this:

if (isset($POST_HTTP_VARS['login']))

isn't used anymore, and if it was, it is still wrong, it USED to be HTTP_POST_VARS, so, instead of what you have, use:

if (isset($_POST['login']) && $_POST['login'] == "Log in")

bradgrafelman

Some more comments about your code...

Array indeces in your case should be strings. $row[name] does not have a string as an index, but a constant. PHP will detect this (assuming there actually isn't a constant named 'name') and throw an E_NOTICE and then assume it is a string. So, use quotes: $row['name'].
Arrays, more specifically items in arrays referenced by indeces, should not simply appear inside a double-quoted string. If they do, they should be wrapped in braces ( {} ). Instead, I usually escape out of the string and concatenate the array in the middle, like so:
```
echo 'Your name is: ' . $row['name'] . '! Hello there.';
```
It appears as though you're vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a SQL query! Instead, sanitize it with a function such as [man]mysql_real_escape_string/man.