Can't seem to get this login to work

Wales

I just keep on getting my else statement. What did I miss?

if ( isset ($_POST['login'])) {


$username = trim(mysql_real_escape_string($_POST['username']));
$password = sha1(trim(mysql_real_escape_string($_POST['password'])));
$query = "SELECT * FROM members WHERE username='$username' and password='$password'";
$result = mysql_query($query);
// Mysql_num_row is counting table row
$count = mysql_num_rows($result);
// If result matched username and password, table row must be 1 row
	if($count == 1){
// Register username and password and redirect to file "member.php"
	$_SESSION['username'];
	header('member.php');
	} else {
		echo "The username and password do not match.";
	}
}

NogDog

Start by making sure your query is working OK:

$result = mysql_query($query);
if($result === false)
{
   // debug code -- don't use this is production version
   echo "Query failed: " mysql_error() . "<br>$query";
   die();
}

For the production version, do something more graceful that won't output database details to the browser (e.g.: use error_log() to write the error info to a log file).

Wales

No errors for the query. Is if($result === false) suppose to only have ==?

NogDog

Nope, "==" means "is equal to" whereas "===" means "is identical to" (same value and type).

Wales

NogDog wrote:
Nope, "==" means "is equal to" whereas "===" means "is identical to" (same value and type).

So why not just do = instead of ===? Is there a difference?

jesuslover037

Make sure you aren't double hashing your password. That happened to me once. I went into my database like NogDog said and found out that I was using the PASSWORD field in mysql and using an md5 hash--great security ha ha but not good for matching passwords.

jesuslover037

Also, try echoing your query statement to see exactly what is being fed into MYSQL. I noticed you don't have your $username and $password seperated in your query statement. I always do it like this because it seems to clear up alot of problems with strings not matching:

$query = "SELECT * FROM members WHERE username= ' " . $username . " ' and password= ' " . " $password . " ' ";

NogDog

Wales wrote:
So why not just do == instead of ===? Is there a difference?

Yes, as I said in fewer words above, "===" only evaluates as true if both expressions are equal and of the same type, whereas "==" evaluates as true even if the expressions are different types, as long as they evaluate to the same value when cast to the same type. Therefore:

(false == false) // true
(false == 0)     // true
(false == "")    // true
(false == null)  // true
// but...
(false === false) // true
(false === 0)     // false
(false === "")    // false
(false === null)  // false