Login (script inside)

[shmony]

I'm just trying to practice at php by building a login script, but it always says that I'm logged in no matter what I put in. Here's the script that I tried:

<?php
$user="username";
$password="password";
if ($username=$user && $pass=$password)
{
$loggedin="true";
}
else
{
$loggedin="false";
}

if ($loggedin=="true")
{
print "You are now logged in.";
}
else
{
print "Wrong username/password.";
}
?>

Do you see any errors in that?

[Anon]

Your first if() statement uses single equal signs instead of double equal signs. This causes the statement to always be true.

[shmony]

yes, but a single equals sign is used to compare a variable to another variable, and a double equals sign is used to compare a variable with a value. dont I need a variable comparison to the variables?

[shmony]

never mind...I got it to work with the double equals sign...thanks.

[Anon]

of course with the way you wrote it, the back door is look at the script with a ?loggedin=true.

TRUE and FALSE have there own meanings, dont use quotes on them and you will use em.

best way is

if($username==$user && $pass==$password) {
echo 'You are now logged in.';
} else {
echo 'Wrong username/password.';
}

[shmony]

that would be good if I wasnt going to use the variable "loggedin" in no other pages. but I am going to use the variable in other pages, so that wouldnt work.

[Anon]

that why you set a cookie with user and pass md5ed and not even use the loggedin. Or sessions. Theres tons of ways to do it, but having a global var that holds if your logged in or not can just be overwritin within the url. If you use sessions you can do that because sessions cant be overwritin globaly