Php - mysql store data and use it later?

[zero_ZX]

Hi, i' making a login page at the moment, however my username + password is stored many different places, and is kinda hard to get, so I have written this entire code:

<?php
session_start();
// dBase file
include 'inc/config.php';

if ($_GET["op"] == "login")
{
if (!$_POST["username"] || !$_POST["password"])
  {
  die("You need to provide a username and FG-Pass.");
  }

// Create query
  $id = "SELECT member_id FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' ";

$q = "SELECT * FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' "
  ."AND `p_locked`=0 "
  ."AND SELECT field_13 FROM `pfields_content` "
  ."WHERE `id`='".$id."' "
  ."AND WHERE `field_13`=('".$_POST["password"]."') "
  
  ."LIMIT 1";
// Run query
$r = mysql_query($q);

if ( $obj = @mysql_fetch_object($r) )
  {
  // Login good, create session variables
  $_SESSION["valid_id"] = $obj->id;
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();

  // Redirect to member page
  Header("Location: shop.php");
  }
else
  {
  // Login not successful
  die("Sorry, could not log you in. Wrong login information.
  <br> Or your fg has been locked. Please contact Smilie.");
  }
}
else
{
//If all went right the Web form appears and users can log in
echo "<form action=\"?op=login\" method=\"POST\">";
echo "Username: <input name=\"username\" size=\"15\"><br />";
echo "FG-Password: <input type=\"password\" name=\"password\" size=\"8\"><br />";
echo "<input type=\"submit\" value=\"Login\">";
echo "</form>";
}

?>

 

So, the process:

1. I get and store the member id:

// Create query
  $id = "SELECT member_id FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' ";

 

Then:

Check if:

-Account is not locked

-Get password for a different table, using the member id we got above.

-Check if username + password matches.

-login

$q = "SELECT * FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' "
  ."AND `p_locked`=0 "
  ."AND SELECT field_13 FROM `pfields_content` "
  ."WHERE `id`='".$id."' "
  ."AND WHERE `field_13`=('".$_POST["password"]."') "
  
  ."LIMIT 1";
// Run query
$r = mysql_query($q);

But this doesn't appear to be the case that it works..

I think it has something to do with that i need to run the query, but i'm not sure, how would i fix this?

 

Thanks in advance!

[monkeytooth]

What errors are you getting in specific when you try to run your script? We always need that. As much as we all like to help here, without know what the exact problem is we can't help. We don't know what we are looking for.

[zero_ZX]

I get the die error from the script:

Sorry, could not log you in. Wrong login information.
Or your fg has been locked. Please contact Smilie.

I checked that the login info was correct :/

[zero_ZX]

Bump

[oni-kun]

Bump

 

Well how about storing their ID and password in the same table? If it appears "Wrong info submitted", Than check the query, Does the query lead anywhere that physically exists in your database? This isn't the hardest debug.

[Buddski]

The main issue that I can see if you arent retrieving the id from the Database..

You are only calling one sql query..

This query isnt being called its just being passed into the second query..

$id = "SELECT member_id FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' ";

 

[zero_ZX]

The main issue that I can see if you arent retrieving the id from the Database..

You are only calling one sql query..

This query isnt being called its just being passed into the second query..

$id = "SELECT member_id FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' ";

 

Hm, i tried this:

// Create query
  $id = "SELECT member_id FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' ";
  $result = mysql_query($query);

$q = "SELECT * FROM `members` "
  ."WHERE `name`='".$_POST["username"]."' "
  ."AND `p_locked`=0 "
  ."AND SELECT field_13 FROM `pfields_content` "
  ."WHERE `id`='".$query."' "
  ."AND WHERE `field_13`=('".$_POST["password"]."') "

But it didn't seems to work :/

[Buddski]

That will never work..

$sql = "SELECT `member_id`, `field_13` 
FROM `members`
Inner Join `pfields_content` USING(`member_id`)
WHERE `p_locked`= 0 AND `name`='".$_POST['username']."' AND `field_13`='".$_POST['password']."'";

Should be what your after..

[zero_ZX]

Thanks, but field_13 is not in the member table, but in pfields_content :/ so i need something like

SELECT field_13 FROM `pfields_content`

[Buddski]

Ive been writing SQL queries for a while now..Im pretty sure that its right..

Theres no harm in trying it is there?

[zero_ZX]

Okay it works.. can you please explain how, cause i dont understand it

[Buddski]

Ok..

The Inner Join will join the FROM table ('member') to the Inner Join table ('pfields_content') USING the member_id.

Which basically means that you can now access all the fields from both of these tables..

There are also LEFT Join, Right Joins, and Outer Joins but ill explain the Inner join for now..

With the use of inner join BOTH fields must have a member_id the same.. so if you have an id in the members table and nothing in the pfields_content table your sql query will return no results because it doesnt exist in both..

 

Have a read of the MySQL ref. manual if you wanna know more.