[RESOLVED] Why did this stop working?

endl

This used to work just fine. Now I cannot get it to display the ...

$first = $row["firstName"];
$last = $row["lastName"];
$user = "$first $last";

Why is this?

Thank you.

<?

$dbh=mysql_connect  ("Server", "user", "pass") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("database");


$sql = "select username, password, firstName, lastName FROM sites where username='$username' AND password='$password'";



$result = mysql_query($sql)or die(mysql_error()); 
$num = mysql_num_rows($result);
$row = mysql_fetch_array($result);

$first = $row["firstName"];
$last = $row["lastName"];
$user = "$first $last";


if ($num == 1) {  echo "$user";



//setcookie("id",$user,time() + 7200,"/lounge","",0);

//header("location:lounge.html");
}

?>

bradgrafelman

Where are $username and $password ever defined?

endl

The username and password come from a form...

<form action="login.php" method="post" name="login" id="login">
Please log in.<br><br>
Username:<br>
<input type="text" maxlength="100"  name="username"> <br>
Password:<br>
<input type="password" name="password" maxlength="100" >
<input type="submit" name="login" value="Log In">
</form>

bradgrafelman

Okay, but that doesn't mean the variables $username and $password are defined.

Instead, you should be using the $_POST superglobal array to retrieve information that was POST'ed to the PHP script. See this manual page for more info/examples: [man]variables.external[/man]. The reason this stopped "working" is that register_globals was disabled (as it should be! - see this man page to learn why: [man]security.globals[/man]).

Also note that user-supplied data should never be placed directly into a SQL query string else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data).

endl

Thanks.

I'm getting closer and this is what I have but keep getting "Query is empty" messages...

<?

$username=$_POST['username'];
$password=$_POST['password'];

$link = mysql_connect("", "", ""); if (!$link) {
    die('Not connected : ' . mysql_error());
}

mysql_select_db('database', $link);
if (!$db_selected) {
    die ('Can\'t use database : ' . mysql_error());
}


$query = sprintf("select username, password, firstName, lastName FROM sites where username=''%s'' AND password=''%s'",
 mysql_real_escape_string($user),
 mysql_real_escape_string($password));


$result = mysql_query($sql)or die(mysql_error()); 
$num = mysql_num_rows($result);
$row = mysql_fetch_array($result);

$first = $row["firstName"];
$last = $row["lastName"];
$user = "$first $last";


if ($num == 1) {  echo "$user";


setcookie("id",$user,time() + 7200,"/lounge","",0);

header("location:lounge.html");
}
}
if ($num == 0)  {
echo "You are not authorized! Please try again.</p><br>";

}			

?>

bradgrafelman

You should also be seeing PHP error messages about using an undefined variable; you define $query but then attempt to use $sql.

Also, why do you have double single quotes around the string value in your SQL query?

endl

Ok changed that but not getting any PHP or mysql error messages just the defined "Can't use database".

<?

$username=$_POST['username'];
$password=$_POST['password'];

$link = mysql_connect("", "", ""); if (!$link) {
    die('Not connected : ' . mysql_error());
}

mysql_select_db('database', $link);
if (!$db_selected) {
    die ('Can\'t use database : ' . mysql_error());
}


$query = sprintf("select username, password, firstName, lastName FROM sites where username='%s' AND password='%s'",
mysql_real_escape_string($user),
mysql_real_escape_string($password));


$result = mysql_query($query)or die(mysql_error());
$num = mysql_num_rows($result);
$row = mysql_fetch_array($result);

$first = $row["firstName"];
$last = $row["lastName"];
$user = "$first $last";


if ($num == 1) {  echo "$user";


setcookie("id",$user,time() + 7200,"/lounge","",0);

header("location:lounge.html");
}
}
if ($num == 0)  {
echo "You are not authorized! Please try again.</p><br>";

}            

?>

bradgrafelman

Again, your if() statement there uses $db_selected which hasn't been defined. Perhaps you meant to capture the return value of [man]mysql_select_db/man into such a variable?

endl

Yes, I changed that to...

$db_selected = mysql_select_db('database', $link);
if (!$db_selected)

Thanks a bunch for your assistance. I think it is working now and is improved.
🙂