error in my login script

[andreea115]

hi everyone

i have written a login script that first confirms whether the Users eamil and password match those held in the database and also confirms whether the Users account has been activiated ( i.e if the account has been activate then the data in the 'active' column of the database should be equal to NULL.

Thereafter, it checks what kind of membership the user has (i.e membership 'A' or membership 'F'). It then redirects the member to the appropriate membership page: i.e login page A or login page F.

the problem that i have is that the script does not seem to work. the funny thing is that it worked for several days and then stopped working. i obviosuly have a bug somewhere but cannot find what the bug is. i have tripple checked my code and it seems fine.

i appriciate help from everyone. thank you very much.

$dbc = @mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);



if (!$dbc) {

trigger_error ('Could not connect to MySQL: ' . mysqli_connect_error() );

}








//variable for names     

    $e = '';

    $LN = '';




if(isset($_POST['submit']))

  {



        require_once ('db_fns.php'); // Connect to the db.







if(!empty($_POST['email'])){

    $e = mysqli_real_escape_string($dbc,trim($_POST['email']));



echo $e;



}

else{

    $e = false;

     echo '<p class="error">You forgot to enter your email address!</p>';



}





if(isset($_POST['pass'])){

   $p = mysqli_real_escape_string($dbc,trim($_POST['pass']));

}

  else

  {

    $p = false;        

   echo '<p class="error">You forgot to enter your password!</p>';





  }    





if ($e && $p) { // If everything's OK.





    $select =  "  SELECT 

                        first_name , 

                        membership_type , 

                        user_id, 

                        user_level ";

    $from = "    FROM 

             users    ";



    $where = sprintf("  WHERE

              email = '%s', 

              AND pass='%s' ,

              AND active = 'NULL'



              ", 

               mysqli_real_escape_string(trim($e)),

               mysqli_real_escape_string(trim(SHA1("$p") ))



                              );





    $order = "  ORDER BY  user_id DESC  LIMIT 1";



    $query = $select.$from.$where.$order;





    $result = mysqli_query($query);



    confirm_query ($result);





    if (mysqli_num_rows($result) == 1) { // A match was made.



            // Register the values & redirect:





            $_SESSION = mysqli_fetch_array ($result, MYSQL_ASSOC); 



            $returns=$_SESSION;





            $membership_type = $returns[ 'membership_type'  ];






    }



if ( $membership_type ==  'A' )  

    {

                       $A_id =  $_SESSION['user_id']; 



            mysqli_free_result($r);

            mysqli_close($dbc);

            $url = BASE_URL . 'index.php?view=loginA';// Define the URL:



            ob_end_clean(); // Delete the buffer.

            header("Location: $url");

            exit(); // Quit the script.





    }

    elseif  ( $membership_type ==  'F' )  



    {

         $f_id  =  $_SESSION['user_id']; 





            mysqli_free_result($r);

            mysqli_close($dbc);

            $url = BASE_URL . 'index.php?view=loginF';// Define the URL:



            ob_end_clean(); // Delete the buffer.

            header("Location: $url");

            exit(); // Quit the script.





    }



    else {



         $suspended_id  =  $_SESSION['user_id']; 





            mysqli_free_result($r);

            mysqli_close($dbc);

            $url = BASE_URL . 'index.php?view=login';// Define the URL:



            ob_end_clean(); // Delete the buffer.

            header("Location: $url");

            exit(); // Quit the script.





    }







        }// END of conditional for whether the correct data was submitted to database for login. 





        else { // No match was made.





            echo '<p class="error">Either the email address and password entered do not match those on 

            file or you have not yet activated your account.</p>';

        }





        }//} // End of SUBMIT conditional.

    ?>

    <br /><br />



     <h1 class="main_pageheading1">&nbsp;</h1>

     <h1 class="main_pageheading1">     Login Page for Aupair World Agency     </h1>



<p>&nbsp;</p>

<p>&nbsp; </p>





    <p   class="main_pageheading2" >Your browser must allow cookies in order to log in.</p>



    <br /><br /><br />



<p>&nbsp;</p>

<p>&nbsp; </p>








<form action="index.php?view=login" method="post">



    <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse"   align="center" 

    bordercolor="#FCF3E5" width="85%" id="AutoNumber6" height="200">







    <tr>

    <td width="50%" class="forms"  >





    <strong>Email Address:</strong> 



        </td>





    <td width="50%" class="forms"   >    





     <?php echo '<input type="text" name="email" size="20" 

    maxlength="80"  style="font-family: Tahoma; width: 300px;  height: 30pt;     font-size: 16pt"

       value="' . $e . '"  />'; ?>     







      </td>

    </tr>







<tr>

    <td width="50%" class="forms"   >





<strong>Password:</strong> 



</td>





  <td width="50%" class="forms"   >    





    <input type="text"  name = 'pass'    size="10" 

    maxlength="20"  style="font-family: Tahoma; 

         width: 300px;  height: 30pt; font-size: 16pt"    />



   </td>

   </tr>









 <tr  style="margin-bottom:120px; height: 80px;"   >



    <td   align="center"colspan="2" class="forms"  style="margin-bottom:120px;"    >



          <input type="submit"  name="submit"  size="20"  style="font-family: Tahoma; width: 150px; 

           height: 25pt;    font-size: 14pt"  value="login"  >



    <input type="hidden" name="submitted" value="TRUE" />





</td>

</tr>



      </table>



            </form>

[anoopmail]

can you explain what works and what does not? Is it redirecting to the wrong page or just do not redirect?

[andreea115]

hi

the redirection works.

i think the problem stemms from the early part of the script i.e prior to the

check whether the data from the form was received. i.e

if ($e && $p) { // If everything's OK.

warm regards

Andreea

[johanafm]

You still havn't explained what doesn't work. That is, what do you expect from the script and what actually happens.

[anoopmail]

it will be great to mention which part does not work.
formatted to remove blank lines

<?php
$dbc = @mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
if (!$dbc) {
    trigger_error ('Could not connect to MySQL: ' . mysqli_connect_error() );
}
    //variable for names     

        $e = '';
        $LN = '';
    if(isset($_POST['submit']))
      {
            require_once ('db_fns.php'); // Connect to the db.
    if(!empty($_POST['email'])){
        $e = mysqli_real_escape_string($dbc,trim($_POST['email']));
    echo $e;
    }
    else{
        $e = false;
         echo '<p class="error">You forgot to enter your email address!</p>';
    }
    if(isset($_POST['pass'])){
       $p = mysqli_real_escape_string($dbc,trim($_POST['pass']));
    }
      else
      {
        $p = false;        

       echo '<p class="error">You forgot to enter your password!</p>';
      }    

    if ($e && $p) { // If everything's OK.
        $select =  "  SELECT
                            first_name ,
                            membership_type ,
                            user_id,
                            user_level ";
        $from = "    FROM
                 users    ";
        $where = sprintf("  WHERE
                  email = '&#37;s',
                  AND pass='%s' ,
                  AND active = 'NULL'
                  ",
                   mysqli_real_escape_string(trim($e)),
                   mysqli_real_escape_string(trim(SHA1("$p") ))
                                  );
        $order = "  ORDER BY  user_id DESC  LIMIT 1";
        $query = $select.$from.$where.$order;
        $result = mysqli_query($query);
        confirm_query ($result);
        if (mysqli_num_rows($result) == 1) { // A match was made.
                // Register the values & redirect:
                $_SESSION = mysqli_fetch_array ($result, MYSQL_ASSOC);
                $returns=$_SESSION;
                $membership_type = $returns[ 'membership_type'  ];
        }
    if ( $membership_type ==  'A' )  

        {
                           $A_id =  $_SESSION['user_id'];
                mysqli_free_result($r);
                mysqli_close($dbc);
                $url = BASE_URL . 'index.php?view=loginA';// Define the URL:
                ob_end_clean(); // Delete the buffer.
                header("Location: $url");
                exit(); // Quit the script.
        }
        elseif  ( $membership_type ==  'F' )  

        {
             $f_id  =  $_SESSION['user_id'];
                mysqli_free_result($r);
                mysqli_close($dbc);
                $url = BASE_URL . 'index.php?view=loginF';// Define the URL:
                ob_end_clean(); // Delete the buffer.
                header("Location: $url");
                exit(); // Quit the script.
        }
        else {
             $suspended_id  =  $_SESSION['user_id'];
                mysqli_free_result($r);
                mysqli_close($dbc);
                $url = BASE_URL . 'index.php?view=login';// Define the URL:
                ob_end_clean(); // Delete the buffer.
                header("Location: $url");
                exit(); // Quit the script.
        }
            }// END of conditional for whether the correct data was submitted to database for login.
            else { // No match was made.
                echo '<p class="error">Either the email address and password entered do not match those on
                file or you have not yet activated your account.</p>';
            }
            }//} // End of SUBMIT conditional.
        ?>
        <br /><br />
         <h1 class="main_pageheading1">&nbsp;</h1>
         <h1 class="main_pageheading1">     Login Page for Aupair World Agency     </h1>
<p>&nbsp;</p>
<p>&nbsp; </p>
        <p   class="main_pageheading2" >Your browser must allow cookies in order to log in.</p>
        <br /><br /><br />
<p>&nbsp;</p>
<p>&nbsp; </p>
    <form action="index.php?view=login" method="post">
        <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse"   align="center"
        bordercolor="#FCF3E5" width="85%" id="AutoNumber6" height="200">
        <tr>
        <td width="50%" class="forms"  >
        <strong>Email Address:</strong>
            </td>
        <td width="50%" class="forms"   >    

         <?php echo '<input type="text" name="email" size="20"
        maxlength="80"  style="font-family: Tahoma; width: 300px;  height: 30pt;     font-size: 16pt"
           value="' . $e . '"  />'; ?>     

          </td>
        </tr>
    <tr>
        <td width="50%" class="forms"   >
    <strong>Password:</strong>
    </td>
      <td width="50%" class="forms"   >    

        <input type="text"  name = 'pass'    size="10"
        maxlength="20"  style="font-family: Tahoma;
             width: 300px;  height: 30pt; font-size: 16pt"    />
       </td>
       </tr>
     <tr  style="margin-bottom:120px; height: 80px;"   >
        <td   align="center"colspan="2" class="forms"  style="margin-bottom:120px;"    >
              <input type="submit"  name="submit"  size="20"  style="font-family: Tahoma; width: 150px;
               height: 25pt;    font-size: 14pt"  value="login"  >
        <input type="hidden" name="submitted" value="TRUE" />
    </td>
    </tr>
          </table>
                </form>

[andreea115]

hi

thanks for your kind help and patience on this matter.

I believe that it’s the first part of the script that has the problem i.e
i.e

this is the error message that came up;

An error occurred in script' on line 11:
mysqli_real_escape_string() expects parameter 1 to be mysqli, resource given
Date/Time: 8-24-2011 13:50:58
Line 11 is;
An error occurred in script' on line 11:
mysqli_real_escape_string() expects parameter 1 to be mysqli, resource given
Date/Time: 8-24-2011 13:50:58

Incidentially- I tried the later part of a script as a function and it worked perfectly. Its only when I combined the function with the form that it stopped working. I enclosed the function that works;

function login ( $e= null , $p =null  )

	 {
		db_connect();



	$select =  "SELECT 
                        first_name , 
                        membership_type , 
                        user_id, 
                        user_level ";
	$from = "FROM 
	         users    ";

	$where = sprintf("WHERE
	          email = '%s'
	          AND pass='%s' 
	          AND active = 'NULL'

	          ", 
	           mysql_real_escape_string(trim($e)),
	           mysql_real_escape_string(trim(SHA1("$p") ))


				              );

	$order = "  ORDER BY  user_id DESC  LIMIT 1";

	$query = $select.$from.$where.$order;


	$result = mysql_query($query);

	confirm_query ($result);

//	  $a [ 'users' ] = db_result_to_array($result);


	//  print_r ($a);



	if (mysql_num_rows($result) == 1) { // A match was made.

			// Register the values & redirect:


			$_SESSION = mysql_fetch_array ($result, MYSQL_ASSOC); 
		//	$membership_type = $_SESSION[ 'membership_type'  ];

			$returns=$_SESSION;
	}


	confirm_query ($result);


	 $result = db_result_to_array($result);

echo $result; 

	print_r ( $returns);

	//return  $_SESSION;

}


echo (login( 'a', 'a'  )); 
	

[johanafm]

The error message you gave doesn't match anything on that line in the code you posted, so you will have to look for this error in other places. But this should still be of help.

# Do NOT use the error supression operator: @
# Here you create a connection to the database... See comment on line 19
$dbc = mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);
if (!$dbc)
{
	trigger_error ('Could not connect to MySQL: ' . mysqli_connect_error() );
	/* Unless you use exit or die here, you must enclose the following code in an
	 * else statement. Otherwise you will continue to try and use the database
	 * without having a connection to it, which is guaranteed not to work.
	 */

}
# I'm going with an else block
else
{
	if(isset($_POST['submit']))
	{
		# Line 19: Here you connect to the database... again!
		require_once ('db_fns.php'); // Connect to the db.
	if(!empty($_POST['email']))
	{
		# Here you correctly have a mysqli connection sent as the first parameter
		$e = mysqli_real_escape_string($dbc,trim($_POST['email']));
		echo $e;
	}

# ... snip ...

    $where = sprintf("  WHERE
              email = '%s',
              AND pass='%s' ,
              AND active = 'NULL'
              ",
              	/* here you do not */
				mysqli_real_escape_string(trim($e)),
				/* here you do not */
				mysqli_real_escape_string(trim(SHA1("$p") ))


	# Here you do not
	$result = mysqli_query($query);

[andreea115]

Hi.
You have asked what exactly is wrong with the script and what message is being given.
This is the message that I am consistently receiving is;

mysqli_real_escape_string() expects exactly 2 parameters, 1 given

I think that I have somehow crashed my apache system and it is no longer reading mysqli functions. I think that I somehow crashed the system ( or created an internal bug when I tried to combine two types of connections) ;
I tried to combine the old

mysql connect
with the new

mysqli connect ( I have enclose both below. )
I did this because I got downloaded some scripts that were in the old mysql mode and then drafted some new scripts that were in the mysqli mode.

Prior to trying to combine the two types of connection my login script was working perfectly and had no problems.

However , once I tried to combine the two database connection types I immediately started having problems all over my scripts.

For example , I enclose below a function. This function worked perfectly when I used the mysql connection but simply does not work when I try to use the mysqli fucntions.

 Function Reg11 ( $user_id= null    )

	 {
		global $dbc;

	$pair	= array(); 



	$select =  "SELECT 
		    addjobssought ";
	$from = " FROM 
	         fam_add_jobs_sought ";

	$where = sprintf(" WHERE
	          user_id = '%s'   ", 
	           mysqli_real_escape_string($user_id)
				              );

	$order = "  ORDER BY  user_id DESC LIMIT 1  ";



	$query2 = $select.$from.$where.$order;

	$result2 = mysqli_query($query2);

	confirm_query ($result2);


	  $pair[]= db_result_to_array($result2);


	  return $pair;

}


print_r (Reg11 (5  )); 


	

Regarding the login script

I have gone over this login script a hundred times and there is no logical reason why it should not work; the only logical reason that I have is that I somehow crashed my system when I tried to combine the two database connection types.
So, in conclusion. Is it possible that I am correct. If so, how can I purge the system .

// Make the connection:
$dbc = mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

if (!$dbc) {
trigger_error ('Could not connect to MySQL: ' . mysqli_connect_error() );
}

function db_connect()
{ $connection = mysql_pconnect('localhost', 'namec', 'password');
if(!$connection) {
return false;
}
if(!mysql_select_db('jobolicious'))
{ return false;
}
return $connection;
}

[johanafm]

andreea115;10986776 wrote:

Hi.
You have asked what exactly is wrong with the script and what message is being given.
This is the message that I am consistently receiving is;

mysqli_real_escape_string() expects exactly 2 parameters, 1 given

Yes, but you previously posted an error message pointing out line 11, which didn't match an error in the code you posted.

However, I did repost your code with comments, and they do talk about this issue (and other things). So reread my post, and especially actually read the code I posted in it, including the comments.