Login Verification problem

[guarinnd]

Hello.

 

I have recently been working on a php script to verify that the login information is correct, and redirect them to a seperate page depending on the result. I seem to have come across a problem. I keep getting redirected to the failed login page, even if I enter correct information. If anybody has time, could you please explain to me what I am doing wrong? The Source code is listed below.

 

Thank you in advance.

 

<?php
$passhash = md5($_post["password"] + "1a2b");
$usrnm = $_post["username"];
$usrnm = @strip_tags(stripslashes($login));

@mysql_connect("localhost","tgschr_verify","123") or die("Cannot Connect to MYSql Database");
@mysql_select_db("tgschr_login");
$sql = "SELECT member_id FROM Users WHERE Username='.$usrnm' AND Password='.$passhash' LIMIT 1";
$r = mysql_query($sql);
if (!$r) {
session_start();
$_session['member_id'] = "'$sql'";
header("Location: http://www.-deleted url-.com/members/index.htm");
} else {
header("Location: http://www.-deleted url-.com/failed_login.html");
}
?>

[.josh]

First thing I notice is

 

$usrnm = $_post["username"];
$usrnm = @strip_tags(stripslashes($login));

 

perhaps you meant to put $usrnm instead of $login? If that doesn't do it, then lemme know.

[guarinnd]

Thank you for that. It did not do anything for my problem, but it should help in the future.

I have also removed the salt at the end of the md5 conversion, and adjusted the MYSql table accordingly, but that still did not help.

 

Edit: Almost forgot. If you need more information, go to http://www.abnormalstatic.com/info.php

[jonsjava]

This code should work (with the MD5 and salted):

<?php
$passhash = md5($_post["password"]."1a2b");
$usrnm = $_post["username"];
$usrnm = @strip_tags(stripslashes($usrnm));

@mysql_connect("localhost","tgschr_verify","123") or die("Cannot Connect to MYSql Database");
@mysql_select_db("tgschr_login");
$sql = "SELECT member_id FROM Users WHERE Username='.$usrnm' AND Password='.$passhash' LIMIT 1";
$r = mysql_query($sql);
if (!$r) {
session_start();
$_session['member_id'] = "'$sql'";
header("Location: http://www.-deleted url-.com/members/index.htm");
} 
else {
header("Location: http://www.-deleted url-.com/failed_login.html");
}
?>