login form probleme

channark

hi i try to create a login form width inscription using md5() function for password and session but when i login its not working no errors nothing, the code after the line that compar md5 db password and form password is not working. please help me.
code for page inscription

<?php
session_start();
if (isset($_POST['insc']))
{
	if (!empty($_POST['user']) || !empty($_POST['pass']))
	{
		mysql_connect('localhost', 'root', '');

	mysql_select_db('test');

	$user = stripslashes($_POST['user']);
	$pass = stripslashes($_POST['pass']);
	$pass = mysql_real_escape_string($pass);
	$user = mysql_real_escape_string($user);

	$time = time();
	$day = date("y/m/d",$time);
	$select = "INSERT INTO `user` (user, pass, date) VALUES ('".$user."','".md5($pass)."', '".$day."') ";
	mysql_query($select);

	header("location:login.php?ins=ok");	

}
else{
	$erreur = "<p>all informations must be entred</p>";
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>inscription</title>
</head>

<body>
<?php if (isset($erreur)){echo $erreur;} ?>
<form name = "insc" method = "post" action = "<?php echo $_SERVER['PHP_SELF']; ?>">
<p>
user : <br/>
<input type="text" name="user" maxlength = 20 />
</p>
<p>
Password : <br/>
<input type="password" name="pass" maxlength = 20 />
</p>
<p>
<input type = "submit" name="insc" value = "inscription" />
</p>
<form>
</body>
</html>

code for login page

<?php
session_start();
if (isset($_GET['ins']))
{
	$mssg = "<p>you succesly registred</p>"; 
}
if (isset($_POST['log']))
{
	if (!empty($_POST['user']) || !empty($_POST['pass']))
	{
		$con = mysql_connect('localhost', 'root', '');

	mysql_select_db('test');

	$user = stripslashes($_POST['user']);
	$pass = stripslashes($_POST['pass']);
	$pass = mysql_real_escape_string($pass);
	$user = mysql_real_escape_string($user);

	$select = "SELECT * FROM `user` WHERE user = '".$user."' ";
	$do = mysql_query($select, $con);

	if ( mysql_num_rows($do) == 1)
	{
		$select_array = mysql_fetch_array($do);
		if ($select_array['pass'] == md5($pass))
		{
			$_SESSION['user']=$user;
			$_SESSION['pass']=$pass;

			header("location:index.php?log=ok");
		}

	}
	else{
		$erreur = "<p>password or username incorrect</p>";
	}
}
else{
	$erreur = "<p>all informations must be entred</p>";
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>login</title>
</head>

<body>
<?php if (isset($erreur)){echo $erreur;} ?>
<?php if (isset($mssg)){echo $mssg;} ?>
<form name = "login" method = "post" action = "<?php echo $_SERVER['PHP_SELF']; ?>">
<p>
user : <br/>
<input type="text" name="user" maxlength = 20 />
</p>
<p>
Password : <br/>
<input type="password" name="pass" maxlength = 20 />
</p>
<p>
<input type = "submit" name="log" value = "login" />
</p>
<form>
<p><a href="inscri.php">inscription</a>
</body>
</html>

page of index after login

<?php
session_start();
if (isset($_GET['deco']))
{
	session_destroy();
}
if (!isset($_SESSION['user']) && !isset($_SESSION['pass']))
{
	header("location:login.php");
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Ty
pe" content="text/html; charset=utf-8" />
<title></title>
</head>

<body>
<h1>Welcom to home page</h1>
<p>user : <?php echo $_SESSION['user']; ?></p>
<p><a href="index.php?deco=ok">deconnection </a></p>
</body>
</html>

Neville1985

channark;10981906 wrote:
hi i try to create a login form width inscription using md5() function for password and session but when i login its not working no errors nothing, the code after the line that compar md5 db password and form password is not working. please help me.
//....
if ( mysql_num_rows($do) == 1)
{
    $select_array = mysql_fetch_array($do); //this generates a numerical array
    if ($select_array['pass'] == md5($pass))
    {
        $_SESSION['user']=$user;
        $_SESSION['pass']=$pass;

   header("location:index.php?log=ok");
}        
}
//....

From what I can tell your using mysql_fetch_array() to generate your result array. This function generates a numerical array, so selecting your password field would be $select_array[1]. (commented line)

There are three ways of achieving the same result, although both number two and three are effectively the same thing, just two different ways of achieving the same result.

Number 1:

//....
if ( mysql_num_rows($do) == 1)
{
    $select_array = mysql_fetch_array($do);
    if ($select_array[1] == md5($pass)) //change to this
    {
        $_SESSION['user']=$user;
        $_SESSION['pass']=$pass;

   header("location:index.php?log=ok");
}        
}
//....

Number 2:

//....
if ( mysql_num_rows($do) == 1)
{
    $select_array = mysql_fetch_array($do, MYSQL_ASSOC); // change to this
    if ($select_array['pass'] == md5($pass)) 
    {
        $_SESSION['user']=$user;
        $_SESSION['pass']=$pass;

   header("location:index.php?log=ok");
}        
}
//....

Number 3:

//....
if ( mysql_num_rows($do) == 1)
{
    $select_array = mysql_fetch_assoc($do); //change to this
    if ($select_array['pass'] == md5($pass))
    {
        $_SESSION['user']=$user;
        $_SESSION['pass']=$pass;

   header("location:index.php?log=ok");
}        
}
//....

1: The above is just a small change to your conditional, it will use the result array type (numerical indices) you had originally.

2: You are asking from a string indices array, this is one way of achieving that result. By passing another param into the mysql_fetch_array() function you can force the function to return an associative array. Which by the way you coded it originally is what you wanted.

3: By invoking mysql_fetch_assoc(); you are basically doing what number 2 is doing in another way. Both work fine.

Hope this helps.

Notes:
mysql_fetch_array()
mysql_fetch_assoc()

bradgrafelman

[man]mysql_fetch_array/man defaults to MYSQL_BOTH, so both numerical and associative array index work just fine.