Problem in Login Process Plzz Help urgent

[Mind_freak]

Hello Broda Your Forum is Awesome i am Getting My Problem SOlution So Fastly sir my antoher problem is i donel login script ..... but the problem is i make user in users table in my db .. with this quyery

Field Type Function Null Value

id int(11) 1
firstname varchar(25) My Firstname
lastname varchar(25) My lastname
username varchar(25) myusername
password varchar(32) mymd5 of password
dob date i select dob
gender varchar(1) M

but when i log in with myusername or password i m getting 0 actually i sould get 1 which is my user id but its mean password is not working plzz help me how to work it.

my login script here.

LOGIN SCRIPT:

<?php
require("connect.php");

$post_username = $_POST['username'];
$post_password = $_POST['password'];

if ($post_username&&$post_password)
{

if (strlen($post_username)>25||strlen($post_password)>15)
die ("Username Or Password is too Long");
else
{

//convert password to md5
$post_password = md5($post_password);

//query the database
$login = sprintf("SELECT * FROM users WHERE username='%s' AND password='%s'", mysql_real_escape_string('$post_username'), mysql_real_escape_string('$post_password'));

$rowcount = mysql_num_rows(mysql_query($login));
echo $rowcount;


}

}
else
die ("Username Or Password Required");

?>

[Mind_freak]

Common Some1 Gave me Solution plzzz i badly need it

[Kudose]

If you use better grammar, I am sure you will get an answer. Also, don't expect an answer so quickly. Try to figure it out until someone answers.

[bradgrafelman]

Your problem(s) are using variables inside of a single-quoted string. Variables are not parsed inside of a single quoted string... quick example:

$foo = "Hello world!":

echo "The message is: $foo"; // output: The message is: Hello world!
echo 'The message is: $foo'; // output: The message is: $foo

Then again, wrapping a variable in quotes when you only want the value of that variable is pointless and redundant (and can even change the type of the variable, though that rarely matters in a language so loosely-typed as PHP). If you just want to reference the value of the variable itself as a parameter, then just put the variable name there - don't surround it with quotes at all.

EDIT: Also note that there's no reason to attempt to escape an MD5 hash of a password, since MD5 hashes will only contain hexadecimal characters.

[Mind_freak]

Brad Can u Tell me Where is a Problem in my Code or plzzz also correct it .🙂 Thanx

Or Sorry Sir My english is not good OR next time i take paitience

[Chloria]

<?php
require("connect.php");
$post_username = mysql_real_escape_string($_POST['username']);
$post_password = $_POST['password'];
if ($post_username&&$post_password)
{
	if (strlen($post_username)>25||strlen($post_password)>15)
	{
		die ("Username Or Password is too Long");
	}
	else
	{
		//convert password to md5
		$post_password = md5($post_password);
		//query the database
		$login = "SELECT * FROM users WHERE username='".$post_username."' AND password='".$post_password."'";
		$rowcount = mysql_num_rows(mysql_query($login));
		echo $rowcount;
	}
}
else
{
	die ("Username Or Password Required");
}

?> 

Try that out.

[bradgrafelman]

Chloria wrote:

Try that out.

Except now you've removed the use of [man]mysql_real_escape_string/man altogether, which means that code will be vulnerable to SQL injection attacks and/or SQL errors.

In other words, I think you meant don't try that out? :p

EDIT2: Woops - didn't see your change at the top of the script as well.

Either way, removing a total of 4 characters from the original code would also fix the issue.

[Mind_freak]

THanx Borthers But i figure this out Thanx to Help 🙂

[Kudose]

As Brad mentioned, variable interpolation occurs within double quotes.

mysql_real_escape_string('$post_username'); // bad
mysql_real_escape_string("$post_username"); // better
mysql_real_escape_string($post_username); // best