[SOLVED] how do you add the $_POST into SELECT * FROM users WHERE password='$password

[supergrame]

$sql="SELECT * FROM users WHERE username="$_POST['username']" and password='$mypassword'";

$result=mysql_query($sql);

 

i dont want to use varibles only the global vars

insted of having this extra code i dont need

 

$mypassword = $_POST['password'];

 

 

[Daney11]

<?php

if (isset($_POST['username']) && isset($_POST['password']))

{

$username = htmlentities($_POST['username']);
$mypassword = htmlentities($_POST['password']);

$sql="SELECT * FROM users WHERE username="$_POST['username']" and password='$mypassword'";
$result=mysql_query($sql);

if (mysql_num_rows($result) >0 )

{

echo "Logged In";

}

}

?>

[zq29]

Your missing some syntax, the ".", which concatenates strings and the single quotes encapsulating the username.

 

$sql = "SELECT * FROM `users` WHERE `username`='".$_POST['username']."' and `password`='$mypassword'";

 

You should be cleansing your data before you start using it in SQL queries, otherwise you could/will suffer from SQL injection attacks.

[supergrame]

Parse error: parse error in C:\wamp\www\public\includes\login.php on line (18)

 

 

(18)  $sql="SELECT * FROM users WHERE username="$_POST['username']" and password='$mypassword'";

 

[zq29]

Parse error: parse error in C:\wamp\www\public\includes\login.php on line (18)

 

 

(18)  $sql="SELECT * FROM users WHERE username="$_POST['username']" and password='$mypassword'";

 

See my post above, you're missing the concatenation periods.

[Daney11]

change

$sql="SELECT * FROM users WHERE username="$_POST['username']" and password='$mypassword'";

to

$sql="SELECT * FROM users WHERE username="$username" and password='$mypassword'";

[Maq]

You should also use mysql_real_escape_string().

[Anti-Moronic]

You should also use mysql_real_escape_string().

 

Was just going to say that. You should really filter this data first. That is THE most insecure way of checking data in a mysql table.

[supergrame]

ok well the reson for my wanting to do that is that my login table and the php are all in the same page. and i get this error

 

Notice: Undefined index: password in C:\wamp\www\public\includes\login.php on line 7

 

 

so if there is a work around that would be good.

 

im calling login.php from index.php (incase you never guessed that)

[supergrame]

ill just create another file loginExec.php not sure if thats how other people do. but it will work