creating a php-driven login form.

Anon

ok, I'm making a 'user control panel' driven by PHP and a mysql database. I keep on getting the same error, so I REALLY would appreciate you guys' help.

this is the form code, coded in HTML only:

<head><title>Administrator Login</title></head>
<body>
<form method="post" action="admincp.php">
Username: <input type="text" name="user" size="20"><br>
Password: <input type="password" name="password" size="20"><br>
<input type="submit" value="Log-on">
</body>

I've had no problem with that code. This is where I get the problem, it's the admincp.php page wich you can see is used after the login attempt:

<?php
$db_name = "novazro";
$connect = mysql_connect('localhost','login removed','password removed');
$db = mysql_select_db($db_name,$connect);
?>

<head><title>Admin Control Panel</title></head>
<body>
<?php
$query = "SELECT password FROM adminlogin WHERE username = $user";
$result = mysql_query($query);
while ($row = mysql_fetch_array($result)) {
$password_check = $row['pwd'];
}

if ($password === $password_check) {

echo "Login Successful!";

}

else {

echo "Login Failed";
}
?>
</body>

the error is the following:

Warning: Supplied argument is not a valid MySQL result resource in /usr/home/novazro/public_html/admin/admincp.php on line 12
Login Failed

if you want to see the script 'active'; here it is: http://www.novaz3ro.com/admin

the login is: beta
password: testing

thanx a lot guys ;-)

Anon

I'm guessing that your mysql dbase isn't returning an error... try adding
print mysql_error();
just after $result = mysql_query($query); and see what is says.

It might also be a good idea to use single quotes around the $user in your $query. It won't hurt, and it's safer to use them than not.

Anon

I added the 'print mysql_error() line and it says this:

You have an error in your SQL syntax near ''user'' at line 1

can you tell me whats wrong?

thanx

Anon

try this:

single quotes around $user

$query = "SELECT password FROM adminlogin WHERE username = '$user'";

echo $query;

to print the $query and see the data

hth
Bastien

Anon

this is what it shows:

SELECT password FROM adminlogin WHERE username = 'beta'
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home3/novaz3ro/public_html/admin/admincp.php on line 14
Login Failed

Anon

$query = "SELECT password FROM adminlogin WHERE username = '$user'";

is incorrect syntax for a variable... you need double quotes for a variable.

try

$query = 'SELECT password FROM adminlogin WHERE username = "$user"';

$query = "SELECT password FROM adminlogin WHERE username = \"$user\"";

the \ lets the comp know it's not the end of the query

Anon

your progressing dude, but your using way too many variables, not that its a bad thing, but it takes more time

Heres what you did wrong. You see, the problem is that the query either isn't correct, or you mispelled somthing, or theres some type of error with the DB.

In your case you did 2 things wrong.

For your future refrence, and I don't know if its nececary or not, but what I do at the end of all my mysql queries, is I put a ; (I don't know if its nececary, but I do it anyways) If your gonna do that, then don't leave any spaces between it and the rest of the queri.

EX: $query = "SELECT password FROM adminlogin WHERE username = $user;";

The second thing, is that you didn't single quote the result.

EX: $query = "SELECT password FROM adminlogin WHERE username = '$user';";

So try that one. If it doesn't work, then you either misspelled somthing or somthing isn't right with the DB.

----Superbronx