PHP Syntax error

[CodySP]

Hello PHP Builder community, as this is my first post I will get straight down to business by saying hello! Now on to further matters.

I've incredibly new to the PHP language having just started using tutorials to guide my path to righteousness! Upon testing the specific PHP page I get this error

Parse error: syntax error, unexpected T_ELSE in /home/morethan/public_html/lt/login.php on line 37

And of course the code for this page

<?php

$username = $_POST['username'];
$password = $_POST['password'];

if ($username&&$password)
{
$connect = mysql_connect("localhost","blank","blank") or die ("Could not connect");
mysql_select_db("morethan_test") or die ("Database not found");

$query = mysql_query("SELECT * FROM phplogin WHERE username='$username'");

$numrows = mysql_num_rows($query);

if ($numrows!==0)
{

 while ($row = mysql_fetch_assoc($query))
{
		$dbusername = $row['username'];
		$dbpassword = $row['password'];

}

 // check to see if they match
 if ($username==$dbusername&&password==$dbpassword)
 {
	echo "You're in!";
 }
 else
	echo "Incorrect Password!";

}
else
	die("That user does not exist!");

else
	die("Please enter a Username and Password");

?>

Note that the original text marked as "Blank" have been replaced for my own security

Kind Regards

Cody

[jeepin81]

well.. you've got multiple issues going on. such being not closing your if statements(both of them one of which does nothing), calling multiple else statements back to back, missing the "$" on your password variable and killing the script and echoing a false error w/ die instead of taking action.

<?php 

$username = $_POST['username']; 
$password = $_POST['password']; 

if ($username && $password) 
//ummmm if what about these variables? if isset()? strlen > than? some kind of condition?
{ //not closed
$connect = mysql_connect("localhost","blank","blank") or die ("Could not connect"); 
mysql_select_db("morethan_test") or die ("Database not found"); 

$query = mysql_query("SELECT * FROM phplogin WHERE username='$username'"); 

$numrows = mysql_num_rows($query); 

if ($numrows !== 0 ) 
{ //not closed

while ($row = mysql_fetch_assoc($query)) 
{ 
        $dbusername = $row['username']; 
        $dbpassword = $row['password']; 

} 

// check to see if they match 
if ($username == $dbusername && $password == $dbpassword) { //missing "$"
    echo "You're in!"; 
} 
elseif($password !== $dbpassword){ 
    echo "Incorrect Password!"; 

} //back to back else statement
elseif($username !== $dbusername){
    die("That user does not exist!"); 
}//back to back else statement
else{ 
    die("Please enter a Username and Password"); 
}


//close if statement(s) both of them
}
}
?>

you might want to think about sanitizing the data as well. Right now you're wide open to injections.

[traq]

you're missing quite a few curly braces, so execution is getting messed up. I don't see a matching number of ifs and elses, so I'm not sure how your code is supposed to clean up.

However, this is a not a great approach in general:

1. first and foremost, NEVER put user input into a database query without validating/ sanitizing it. You're wide open to errors and database injection.

2. Instead of pulling an entire user row, simply check for matching username and password in a single query:

   $username = mysql_real_escape_string($_POST['username']);
   $password = mysql_real_escape_string($_POST['password']);
   
   $query = mysql_query("SELECT `username` FROM `phplogin` WHERE `username`='$username' AND `password`='$password' LIMIT 1");
   
   if(mysql_num_rows($query) === 1){ echo "You're in!"; }
   else{ echo "Password and Username don't match."; }

   3. As shown above, don't tell the user what went wrong, just that it didn't match. If a malicious user knows they got the password right, they can confidently focus on figuring out the username. Plus it simplifies the code a lot.

[CodySP]

Thanks for the speedy replies! As I said I'm incredibly new to PHP so errors are to be expected 🙂

Thanks for cleaning me up a little bit!