Urgent help

efimmike

I created a single table database, i have an ndex.php and login.php. I am using WAMP & dreamweaver, the server testing connection is correct as seen in my dreamweaver Local File menu.

I checked several times the ndex.php is correct but when i fill it and submit (Login) the login.php displays a blank page, it does not echo any error message or connection massage.

these are the codes;
PHP Code:

ndex.php

<table width="300" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
<tr>
<form method="post" action="login.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">

<tr>
<td colspan="3"><strong>  </strong></td>
</tr>

<tr>
<td colspan="3"><strong>Member Login </strong></td>
</tr>
<tr>
<td width="78">Username</td>
<td width="6">:</td>
<td width="294"><input type="text"  name="username"></td>
</tr>
<tr>
<td>Password</td>
<td>:</td>
<td><input type="password" name="password" ></td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
<td><input type="submit" value="Login"></td>
</tr>
</table>
</td>
</form>
</tr>
</table>

login.php

<?
$username = $_POST["username"];
$password =$_POST["password"];

if($username&&$password)
{
$connect= mysql_connect("localhost" , "root", "") or die("Couldn't connect!");
msql_select_db("phplogin") or die ("couldn't find db");


$query = mysql_query(" SELECT * FROM users WHERE username='$username' ");

$results = mysql_fetch_array("$query");

  echo $numrows; 

}

else

  die("Please enter a username and a password!");

?>

bradgrafelman

Hi there, and welcome to PHPBuilder! Note that I added [noparse]

..

and

..

[/noparse] bbcode tags to your post. Please use these tags in the future when posting code as they make your posts much easier to read and analyze.

As for your problem, you have a typo here (forgot the 'y' in 'mysql'):

msql_select_db("phplogin")

If you're developing scripts locally, however, you should have PHP's error messages turned on so that you can more easily debug problems. Before fixing the issue I mentioned above, you should open your php.ini file and set display_errors to On and error_reporting to E_ALL - that way you can see any and all errors in your scripts while you're developing them.

halojoy

There were a few small errors, like msql_select_db("phplogin")
and the mysql_num_rows()

<?php

error_reporting(E_ALL); // php debug
ini_set('display_errors', '1'); // php debug

if(!isset($_POST["username"])) exit('you are not from login form');

$username = $_POST["username"];
$password = $_POST["password"];

if($username && $password){
  $connect= mysql_connect("localhost" , "root", "") or die("Couldn't connect!");
  mysql_select_db("phplogin") or die ("couldn't find db");

  $result = mysql_query("SELECT * FROM users WHERE username='$username' ");
  $num = mysql_num_rows( $result );

  if($num == 1){
      $user = mysql_fetch_array( $result );
      // check password here

  }  else{
      echo ( 'no such user' );
  }

}else{
    die("Please enter a username and a password!");
}

?>

efimmike

thanks for your timely reply unfortunately the password is not validated only the username.
regards.

bradgrafelman

efimmike;10942153 wrote:
thanks for your timely reply unfortunately the password is not validated only the username.
regards.

Well of course it's not validated... you didn't check the password anywhere.

If you want to SELECT the user in the DB only if the password matches, then you need to add that condition in your WHERE clause.

EDIT: Also note that your code is vulnerable to SQL injection attacks (and/or just plain SQL errors). User-supplied data should never be placed directly into a SQL query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.