user login help

[scmeeker]

My user login form works BUT I would like it to also check another field called "status" in the table before moving on to a successful login.  I want it to check to see if the user status is "activated" or the login will go to an error page.  I've played around with it without much success.  I've inserted a variable for "status" but its not working.  It seems like a simple thing....but it keeps going to the success page even when the $mystatus should fail.

 

Here is the code:

 

<?php
session_start();



// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form
$myusername=$_POST['username'];
$mypassword=$_POST['password'];
$mystatus=$_POST['status'];

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername', password='$mypassword' and status='$mystatus'";
$result=mysql_query($sql);

if ($mystatus!="activated"){
header("location:error.php");
}else{

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
$_SESSION['username'] = $myusername;
session_register("password");   
header("location:listtest5.php");
}
else {
header ("location:userlogin_error.php");
} 
}
?>

[Pikachu2000]

Shouldn't the user's status come from a flag, set in a database field, not from a form field? In any event, you need to call exit() after any header() redirect to stop the script from executing any further.

 

if ($mystatus!="activated"){
     header("location:error.php");
     exit();
}else{