PHP and MY SQL Problem

[bhikha]

Can anyone see what is wrong with the following code? I am trying to set up a password feature on my website but i keep coming back with error messages when testing!

 

{
$Link = mysql_connect($Host, $User, $Password);

$Query = "SELECT Username, PassWord, name FROM $table_1 WHERE Username = '$UserName' AND Password ('$PassWord')";
$Result = mysql_db_query ($DBName, $Query, $Link);

(LINE 50)$num_rows= mysql_num_rows($Result);
(LINE 51)$PassWordMatch=mysql_fetch_array($Res…

if(!($num_rows))
{

$message = "User Name Not Recongised, Please Try Again!";
(LINE 57)header("location: login.php?message=$message");
}
else
{
if($PassWord !=$PassWordMatch['PassWord'])
{

$message = "Password Wrong, Please Login Again!";
header("location: login.php?message=$message");
}
else
{
$_SESSION['name'] = $PassWordMatch['name'];

$message = "Welcome ".$Username."You are now logged in<br>Please continue to<br>use the site!";
header("location: index.html?message=$message");
}
}
}

 

The Errors:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /web/users/j9041310/ICA/PHP/checkDetails… on line 50

 

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /web/users/j9041310/ICA/PHP/checkDetails… on line 51

 

Warning: Cannot modify header information - headers already sent by (output started at /web/users/j9041310/ICA/PHP/checkDetails… in /web/users/j9041310/ICA/PHP/checkDetails… on line 57

 

Edit KP: added code tags

[AbraCadaver]

For testing:

 

$Result = mysql_db_query ($DBName, $Query, $Link) or die(mysql_error());

Also note:

 

Warning

 

This function has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged.

[WebStyles]

The whole script is wrong, think about what it's doing for a second:

 

1. connects to database (ok so far)

2. grabs username and password, from database where username and password match the ones you already have (oppss... in next step you'll see why this is not what you want )

3. check if any rows were returned (if not assume username was wrong. WHY? it could also be a wrong password, you have no way of knowing this)

4. mysql_fetch_array($Res); (where does $Res come from???)

5. header() will only work if you have not outputted anything to the page yet.

6. if($PassWord != $PassWordMatch['PassWord']) // this will NEVER work because you specifically said: grab user,pass where pass is equal to my pass

7. you use $UserName in you query then $Username ( lowercase N) in the last message. One of them is incorrect.

 

Think simple, try something like this:

1. connect to database.

2. grab only password from database where username = '$username' (no need to grab the username because you already have it)

3. if there are no results, then username does not exist

4. if there is a result, compare password with the one returned from database

5. redirect accordingly.

 

hope this helps