Login.php file giving error?

Obrienray1

I'm creating a CMS from scratch and I get this warning

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\login.php on line 27

Shadowcms

© 2011

Devbest

##############################################
*/

//Database Info
$dbhost = "localhost"; // Default is localhost
$dbname = "shadowcms"; //Database
$dbuser = "root"; // Default is root
$dbpass = "password"; //phpmyadmin password

// Connecting to database yay!
mysql_connect($dbhost, $dbuser, $dbpass) or die ("Could not connect: ". mysql_error());
mysql_select_db($dbname) or die (mysql_error());

session_start();
$username = $POST['username'];
$password = md5($POST['password']);

$query = "SELECT * FROM users WHERE username = ’$username’ and password=’$password’";
$result = mysql_query($query);

if(mysql_num_rows($result)!= 1) {
$error = "Failed login";
include "login.htm";
}
else
{
$_SESSION['username'] = "$username";
include "me.php";
}
?>][/code]

BrightIdeas

I hesitated to post this because it does not address the question directly, but this is how I would authenticate my users. Simply because this allows me to differentiate between an invalid username and an invalid password.

$username = $_POST['username'];
$password = md5($_POST['password']);

$query = "SELECT username, password 
                  FROM users 
                  WHERE username = '$username'";

$result = mysql_query($query);

$records_found = mysql_num_rows($result);

while ($get_data = mysql_fetch_array($result)) {
  $pwd_in_db = $get_data['pwd_column_in_users_table'];
}

if($records_found != 1) {
  $error = "Invalid username";
  include "login.htm";
}
elseif($pwd_in_db != $password) {
  $error = "Invalid password";
  include "login.htm";
}
else
{
  $_SESSION['username'] = "$username";
  include "me.php";
}

Obrienray1

Thank you very much it gets rid of the warning and I have learned what to do now thanks to you.I don't get a warning nor error just when I log in with my account details it just reloads the page very fast. Any idea why?

BrightIdeas

You mean you enter your creds and it takes you right back to the login page?

Obrienray1

Yes that is what I mean..

BrightIdeas

When a new user is added to the database, how is the password stored in there? I'm questioning the hashing (md5) of the password entered in the form. If the password is 'md5 hashed' when entered into the dabase, will an 'md5 hash' of the same string yield the exact same character string? If not, then that could be the cause of the problem here.

Also, you assign and $error variable, what do you use it for? Do you echo it somewhere later on? We could use that to throw a javascrip warning box showing us if the authentication fails on the username or on the password.

Obrienray1

Kinda new to PHP but the register page was very easy to do. I was using the $error because I wanted it to echo the error. Maybe you can fix my code up?

BrightIdeas

Add this on line 3 or so:

if (isset($error)){
  echo $error;
}

That should put your error readout somewhere near the top of the page.

Obrienray1

Okay I'm sorry for making you do all this but I really need help 😉.

BrightIdeas

That's quite alright... that's what these forums are for... I think 😃

Obrienray1

Sorry for double posting but I can't find the edit button for my post so sorry moderators.

I put the code underneath the / / coding and it doesn't show my error.

BrightIdeas

I hate to do this to you but I need to call it a night... can you post your users table structure (just the column headers) and the copy-paste the code as you have it now? I'll have a look at it in the morning (unless someone else beats me to it). I was hoping to get your issue solved a lot quicker, but there's something I must be missing somewhere... it might just be I need some sleep, it's easier to read the boards with eyes open.

Cheers.

Obrienray1

Same I need to sleep and tomorrow in the morning I will do that. Thanks for all your help today.