Login system

[MerlinJR]

I'm working on my login system but my code doesn't work. it is always skip the "true" part, so basically dosen't matter if the user and pass I entered is right or wrong it's always said it's wrong. Please help....

 

<?php

 

session_start();

extract($_POST);

 

 

$host = 'localhost';

$user_name = '';

$password = '';

$data_base = '';

 

$connect = @mysqli_connect ($host, $user_name, $password, $data_base)or die('Error connecting to mysql');

 

$username=$_POST['user'];

$password=$_POST['pass'];

 

$query="SELECT * FROM user WHERE username='$username' and pass='$password'";

$result=mysqli_query($query);

 

$count=mysqli_num_rows($result);

 

if($count==1){

  $_SESSION['login'] = true;

header('location: location: ../main.php');

exit;

}

 

$_SESSION['error'] = 'Wrong name or password.  Try again.';

header('location: login.php');

?>

[ManInBlack]

no my bad.

[Deoctor]

have u checked whether u are able to extract the $username and $password correctly. try using an echo before $hostname and see what values ur getting for $username and $password

[trq]

You extract $_POST (which is a terrible idea) then override the $password variable within your script. This is indeed one reason why register_globals has been switched off and simply replacing it by extracting $_POST into the global namespace is a bad idea.

[avario]

Maybe I am just really stupid but isn't this:

 

$result=mysqli_query($query);

 

meant to be written like this:

 

$result=mysql_query($query);

 

without the i? Or is that just something different?

[cags]

mysqli is mysql improved it contains mainly the same functions but under mysqli_ rather than mysql_

[Deoctor]

if u just open ur phpinfo file then it would b something like that shown in the jpg file. if the mysqli

mysqli.allow_local_infile is off then u cannot use this one..

if u want to know difference between both u can check it out here..

mysqli is the improved mysql extension for php.

they both provide access mysql features.   

 

[attachment deleted by admin]

[trq]

if the mysqli

mysqli.allow_local_infile is off then u cannot use this one..

 

All that means is you can't use a local ini file for configuration. If mysqli is not installed you wont see anything about it within your phpinfo() output.

[Jakehh]

There are two password variables.