Need help

[Butler]

<?php

include ('connection.php');

 

$username=$_POST['username5'];

$password=$_POST['password5'];

 

      $query="SELECT password FROM merchants WHERE username = '$_POST(username5)'";

if ($password == $query)

{

$url = "SELECT url FROM merchants WHERE username = '$_POST(username5)'";

header("Location: $url");

}

else

{

//change later

echo urgh

}

?>

 

I am self taught and am trying to figure soe things out and i am unable to get this to work. Can anyone help?

 

[bamfon]

There no point telling it user $username=$_POST['username5'];  then using $_POST['username5']; in the query

<?php
include ('connection.php');

$username=$_POST['username5'];
$password=$_POST['password5'];

      $query="SELECT password FROM merchants WHERE username = '$username'";
if ($password == $query)
{
$url = "SELECT url FROM merchants WHERE username = '$username'";
header("Location: $url");
}
else
{
//change later
echo urgh;
}
?>

What error are you getting?

 

 

You could use the one below thats working it will do the same thing as your one

<?php


$username = $_POST['username'];
$password = $_POST['password'];



$sql="select * from merchants  WHERE username='$username' and password='$password' ";
$res=mysql_query($sql);
if(!$res)
{
die('error loging');
} 
$row=mysql_fetch_array($res);
if(mysql_num_rows($res)>0)
{
$url = "SELECT url FROM merchants WHERE username = '$username'";
header("Location: $url");

}
else
{//change later
echo urgh;
}

?>

[ManiacDan]

You're not actually RUNNING these queries.  Right now you just have strings and you're trying to see if the password is equal to the full SELECT statement to view the password.  That would be a funny coincidence, but is not what you want.

 

Also, don't do passwords like this.  Use a one-way hash like sha1 with a salt to encrypt the password so you cannot view them and nobody can steal them.

 

-Dan