Login case sensitivity

[hotdog1983]

Hi, I'm making a login page and I want to allow users type in case-insensitive username and password.

I'm using utf8_general_ci collation.

Here's my PHP code.

 

$username= $_POST['username'];
$password = $_POST['password'];

if ($email&&$password){
$connect = mysql_connect("localhost","root","") or die("Couldn't connect to the database");
mysql_select_db("nemo") or die("Couldn't find the database.");
$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrows = mysql_num_rows($query);
if ($numrows!=0)
	{
	while ($row = mysql_fetch_assoc($query))
		{
			$dbusername= $row["username"];
			$dbpassword = $row["password"];
		}
	if ($username==$dbusername&&$password==$dbpassword)
		{
			echo "Logged in";
		}
		else
			echo "Wrong password."
	}
else
	die("Username not found.");
}
else
die("Enter your username and password.");

 

After doing some search, I found that collation ending with ci means case insensitive.

But I can't log in with ABC if the username in database is abc.

I know I can use strtolower to make everything to lower case but

I'm really curious why this happens.

 

Thank you.

[PFMaBiSmAd]

Did you get your "Username not found." message or some other symptom that leads you to believe that the problem is the database/query and not in comparison in the php code?

[hotdog1983]

Thank you for your answer.

 

No, I'm getting wrong password error.

When the username and password in the database are abc and abc

I can login with abc/abc but not with ABC/abc, abc/ABC, or ABC/ABC.

[fenway]

Well, that's up to you -- you use an "eq" in your php code, and you're not even inspecting the password value via mysql.

[hotdog1983]

Thanks for your reply.

 

I'm in a hurry to finish a site and I actually got that code from watching a Youtube PHP tutorial clip.

I thought that the code itself must be correct.

After struggling for a few hours, I've come up with this.

 

$query = mysql_query("SELECT * FROM users WHERE username='$username' and password='$password'");

 

It works as I wished and I hope this one is properly coded.

Please advise me if it's not.

 

Thank you!

[fenway]

It will "work", but it's preferable to keep the password in scipt.