[SOLVED] Where did i go wrong? Incorrect password

[MDanz]

 

<?php

 

session_start();

    $username = $_POST['username'];

    $password = $_POST['password'];

 

    if ($username==$dbusername&&md5($password)==$dbpassword)

    {

        // connect to db

        $connect = mysql_connect ("localhost", "Master", "password") or die ("cannot connect");

        $db_selected = mysql_select_db ("ustackc1_Login") or die ("cannot connect to db");

 

        // query database

        $query = "SELECT * FROM Users WHERE username='$username' AND password='$password'";

        $result = mysql_query ($query) or die(mysql_error());

        $numrows = mysql_num_rows ($result);

       

        if ($numrows!=0)

        {

            // a row has been found therefore the variables entered must be valid

            echo "You are logged in. <a href='Admin.php'>Click here to enter the Admin Page</a> " . $username;

$_SESSION['username']=$username;

        }

        else

        {

 

            echo "that username/password combination is incorrect";

        }

    }

    else

        die ("please supply both username and password");

?>

 

It says the username/password combination is incorrect?? :'(

[smerny]

where is $dbusername and $dbpassword being set?

 

before that if statement... echo the vars like this

 

echo "username = ".$username."</br>";

echo "dbusername = ".$dbusername."</br>";

echo "password = ".md5($password)."</br>";

echo "dbpassword = ".$dbpassword."</br>";

[MDanz]

k i echoed those out an dbusername and dbpassword are blank.. how do i set this, i thought i did the mysql correct..

[smerny]

where?

 

i don't see you declaring those variables anywhere

[smerny]

you'll need to call the database before you go into your if statement... you'll need to search the database for the username supplied in POST and if it exists, compare the POST password with the db password associated with the POST username

[MDanz]

ok i changed alot and i now it says the user doesn't exist and it does...

 

 

<?php

 

session_start();

    $username = $_POST['username'];

    $password = $_POST['password'];

 

if($username&&$password)

 

{

  $connect=mysql_connect("localhost","Master","password") or die ("Couldn't connect!");

  mysql_select_db("ustackc1_Login") or die("Couldn't connect! ");

 

  $query = mysql_query ("SELECT * FROM Users WHERE username='$username'");

 

  $numrow = mysql_num_rows($query);

 

  if($numrows!=0)

  {

  while($row = mysql_fetch_assoc($query))

  {

      $dbusername = $row['username'];

      $dbpassword = $row['password'];

 

  }

 

  //check to see if they match

 

  if ($username==$dbusername&&md5($password)==$dbpassword)

  {

      echo "Welcome!  <a href='Admin.php'>Click here</a> to enter your Stack page!";

      $_SESSION['username']=$username;

 

  }

  else

      echo "Incorrect Password!";

 

  }

  else

      echo"That user doesn't exist";

}

else

    die("Please enter a username and a password");

?>

 

[MDanz]

nvm i got it

[Maknis]

$numrows as the problem right?

[MDanz]

yep lol thx anyway