[SOLVED] Case sensitive

[regdude]

Hi!

I have made a login script.

It uses DB to get username and password.

But there is a problem with capital letters.

If I use, lets say, 'Username123' then I can get in the site behind login because this is in the DB, but if I use 'username123' I can also get in to the site.

(The script works for checking if password or username is correct).

$password = $_POST['password'];
$username = addslashes($_POST['username']);
$password = md5($password);
$result = mysql_db_query($db, "SELECT * FROM users WHERE username='$username' AND password='$password'"); 
if (mysql_num_rows($result) == 1) {
//... redirect.
}

[DeanWhitehouse]

How are you inserting it, as it may be a problem there?

 

[regdude]

Inserting?

<form  action='logingo' method='post' />
<center>
<table>
  <tr>
    <td>Username: </td>
    <td><input type='text' name='username' size='15' maxlength='20' /></td>
  </tr>
  <tr>
    <td>Password:</td>
    <td><input type='password' name='password' size='17' maxlength='30' /></td>
  </tr>
  
  <tr>
    <td></td>
    <td><input type='submit' value='Login' /></td>
  </tr>  
</table>

[DeanWhitehouse]

sorry, registration.

[revraz]

http://dev.mysql.com/doc/refman/5.0/en/case-sensitivity.html

[Maq]

No, we need the SQL statement, where you actually put it into the database...

[regdude]

I add all the values in the DB manually.

Like I said there is 'Username123' etc.

I need to tell the login script to check if the username is the same even with case-sensitive, because now it doesn't check that.

[Maq]

When you insert and compare the user names you should always use the strtolower or upper to ensure you don't run into this problem.

[bobbinsbro]

revraz is right. mysql strings are case insensitive by default. you have to force case sensitivity wherever you want to use it. revraz provided the link.

[Barand]

try

SELECT * FROM users WHERE BINARY username='$username' AND password='$password'

[revraz]

Wasn't really the solution he was looking for.  The problem is it isn't comparing case and he wants it to.

 

When you insert and compare the user names you should always use the strtolower or upper to ensure you don't run into this problem.

[regdude]

Thanks!

I simply changed the collation in tables.

Because...

non-binary string comparisons are case insensitive by default

[DeanWhitehouse]

Edit: Solved already.

[revraz]

That's fine and Barand's solution should also work if you didn't want to change the table.