[/noparse] bbcode tags as they make your code much easier to read and analyze. Also, you might want to remove/obfuscate your DB credentials next time.
Note that many (including myself) would consider storing the user's password in plain text (i.e. unencrypted) in a cookie to be highly insecure and rather troubling.
Same goes for the database, too.
User-supplied data should never be placed directly into a SQL query, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize it with a function such as [man]mysql_real_escape_string/man (for string data) or use prepared statements.
See this man page for more info: [man]security.database.sql-injection[/man].
Why have useless code like this:
if ($pass != $info['userpassword'])
{
}
else
{
header(" testing_login.php");
}
with empty blocks of code? Save yourself some typing (and us some reading - please!) and instead simply invert the if() condition. That way there's no need to use an 'else' branch at all.
While the above is general coding advice, note that there's probably no need for this while() loop at all. Assuming usernames are to be unique (you do have some sort of UNIQUE/PRIMARY constraint on that column if this assumption is true, yes?), that means you'll only SELECT at most 1 row. Why, then, would you create a loop that can only run at most 1 times (which doesn't sound like a loop at all)?
In addition, why SELECT rows that might not even match all of your criteria? Include the password constraint in the WHERE condition and there will be no need to manually check it in PHP since MySQL won't waste the time returning a row that doesn't match all of your criteria (username and password match) rather than just part of it (username matches).
This:
header(" testing_login.php");
is not following valid HTTP header syntax, thus at best it's going to do nothing.
In addition, the rest of the code is still going to be executed even if that point is reached. Either add an [man]exit[/man] after that header call, or restructure the code so that the execution path doesn't cover all of the processing whether it's needed or not. (Or, better yet; do both.)
Things like this:
//makes sure forms is filled in
if(!$_POST['username'] | !$_POST['userpassword']) {
are, IMHO, a bit sloppy and hard to understand. "If the negated boolean value of $POST['username'] OR'd with the negated boolean value of $POST['userpasswrd'] is true" is how I would read that if() condition out loud; notice how it doesn't make any sense?
Instead, either use something like [man]empty/man or perhaps [man]strlen/man (or whatever else you actually meant to do there) so that the code is more clear (and correct, as a bonus).
//checks against database
if (!get_magic_quotes_gpc()) {
$_POST['username'] = addslashes($_POST['username']);
}
For one, [man]addslashes/man should never be used to prepare data for a MySQL query - it doesn't do the same job as the DBMS-specific escaping functions such as [man]mysql_real_escape_string/man.
For another, you should be checking the opposite condition and ensuring that the dreaded magic_quotes directive is disabled (and, if it isn't, get it disabled!). Otherwise, you'll have to first use [man]stripslashes/man to undo the damage magic_quotes_gpc has caused, but again that should be done only if the directive is indeed enabled.
Don't use 'SELECT *' queries at all (unless you actually mean to select every column in that table, now and in the future even if that table's schema changes - most likely you'll never actually mean this). Instead, only SELECT the columns from which you actually need data (or, if you're just checking for existence, SELECT some small constant value such as the integer 1).
Note that there's nothing wrong with re-using variables for new SQL queries, meaning there's no need to use [man]$check[/b], $check2, ..., $check9001, ... etc. when just $check will do.
It's a bit hard to follow the logical structure of your code due to the lack of consistent indentation/whitespace. Might want to be a bit more careful with that - it can help you just as much as it will us.
These two lines:
setcookie(ID_my_site, $_POST['username'], $hour);
setcookie(Key_my_site, $_POST['userpassword'], $hour);
should be generating error messages, unless you've defined ID_my_site and Key_my_site as [man]constant[/man]s somewhere that you haven't shown us. A [man]string[/man], don't forget, must be delimited in some way (most often using single or double quotes, for example).
Finally, can you show us the row from the DB that matches the account you're using when testing this script? More specifically, have you compared what the password looks like in the DB versus what you're using when attempting to login?
