(You have an error in your SQL syntax) Error

[xela]

Hi all..

I am making a php mysql loginsystem to my webpage.. I got some help from a friend and he said it should work but I get this error :

Query error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '� and password=�' at line 1

I dont know what is wrong.. Please help..

Here is my code :

<?php

session_start();

include 'config.php';

$username = $POST[‘username’];
$password = $POST[‘password’];

$query = "select * from members where username=’$username’ and password=’$password’";

$result = mysql_query($query)
or die("Query error: ". mysql_error());

if (mysql_num_rows($result) != 1) {
$error = "Bad Login";
include "login.html";

} else {
$_SESSION[‘username’] = "$username";
include "memberspage.php";

}

?>

[NogDog]

You have many instances of direction quotes ( ‘ and ’ ) which should be straight, non-directional quotes ( ' ). Make sure you are using a text editor designed for program source code and not a word processor with a "smart quotes" type of feature that automatically changes quotes to left/right directional types.

[peytonrm]

The above is exactly correct.

Some tips: it is a major security risk to stick input from a user directly into a query (do some reading on 'SQL injection attacks' to see why). Try calling mysql_real_escape_string() on your input before passing it to the database. Also, it is a best practice to put your SQL commands in all caps (e.g. SELECT * FROM table) to make it easy for someone reading the query to tell the commands from the table names and columns.