Problems with if statements in a php/mysql login form

[Calamity-Clare]

I have been making a login form for the site I am working on using mysql databases. As per usual member sites, the user registers on the site using a registration form then uses the login form on the index page. I've successfully registered a couple of different test users & retrieved the information I submitted into the database. When I try to log into the member section using the same data that I entered for one of the test users, as long as I correctly enter the username and password, it logs in. Up until that point the process works.

 

I encounter problems when I use an incorrect password. I'm using this if/else statement to process the database query:

 

$query = "SELECT username, password FROM mySQLtest WHERE username='$username' AND password='$password'";

if ($result = mysql_query($query)) { 
  while($row = mysql_fetch_array($result)) { 
   if ($row == 0) { 
    print '<p class="error">The username you entered is invalid. Please try again.</p>';
    } 
   else { 
    print "<p>Welcome $username, your log in was successful.</p>";
    } 
   } 
  } 

 

The 'else' bit of the statement works fine. However, if the details that I enter in aren't correct the 'if' bit of the statement doesn't execute & nothing prints onto the screen.

 

Is there anything that I haven't done correctly in this bit of code? If you want to test it, go to www.optionsstradingaustralia.com.au & use the login at the top of the page. Test users are (& yes to my embarrassment I was in a very Lord of the Rings mood that day ):

    Username: halfing

    Password: the1ring

        or

    Username: wizard

    Password: shadowfax

 

I've attached the whole php script as well.

 

Thanks

 

 

[attachment deleted by admin]

[Yucky]

The problem is that you're checking to see if the value of $row is false/0, but if there are no matches then it's not going to be. Being a novice myself, I can't remember what's stored inside a variable if MySQL doesn't have anything returned. Is it not set, or is it null? Null I'd presume!

 

Anyway, I'd recommend another way of doing things. You can use mysql_num_rows to count the number of rows returned by a query. Perfect for checking a username/password combination!

 

Here's a redone example using mysql_num_rows instead of mysql_fetch_array.

 

$count = mysql_num_rows(mysql_query("SELECT username, password FROM mySQLtest WHERE username='$username' AND password='$password'"));
if ($count == 1) {
   print "<p>Welcome $username, your log in was successful.</p>";
}
else {
   print '<p class="error">The username you entered is invalid. Please try again.</p>';
}

[Calamity-Clare]

Haha I wouldn't have a clue if it's null or not set!

 

Thank you!! In my defense I tried using mysql_nums_rows before & it returned one of those invalid function errors so I figured I had it wrong & tried something else.

 

I also discovered the problems one has the potential to stumble upon while using while statements. Not good

 

Thank you again, much appreciated