My logging script not working...

[ThE_GuN]

It's been a while since I've written any PHP, and I was writing a simple loggin... but I seam to have done something wrong...

 

 

<?php
error_reporting(0);
session_start(); 

// Connects to the database
require 'database.php';
$db = mysql_connect( "$location", "$dbuser", "$dbpass" );
mysql_select_db( "$database" );
if (!isset($_SESSION['log'])) {
  $bads = array("'","<",">",",","$",";",":",".");
  $user = $_POST['user'];
  $user = str_replace($bads,"",$user);
  $pass = $_POST['pass'];
  $pass = str_replace($bads,"",$pass);
  $pass = md5($pass);
  if( isset( $user ) & isset( $pass ) & ctype_alnum($user) ) {
   $sql = "select * from users where user = '$user' and pass = '$pass';";
   $rs = mysql_query($sql, $db);
   if( mysql_num_rows($rs) == 1 ) {
    $_SESSION['log'] = $user;
    break;
   }
   else {
    echo "Wrong username or password, please try again!";
    mysql_close();
   }
  }
  ?>
  <H2 ALIGN="CENTER">Roleplay Login</H2>
  <FORM ACTION="index.php" METHOD="POST">
   <TABLE WIDTH="200" BORDER="0" ALIGN="CENTER">
    <TR>
     <TD>Username</TD>
     <TD WIDTH="105"><INPUT NAME="user" TYPE="text" SIZE="15"></TD>
    </TR>
    <TR>
     <TD>Password</TD>
     <TD WIDTH="105"><INPUT NAME="pass" TYPE="PASSWORD" SIZE="15"></TD>
    </TR>
    <TR>
     <TD COLSPAN="2"><DIV ALIGN="CENTER"><INPUT TYPE="submit" VALUE="Login"></TD>
    </TR>
   </TABLE>
  </FORM>
  <?
}
if (isset($_SESSION['log'])) {

}
?>

 

It gets the info, and I do get the correct SQL sentance in $sql, but $rs seams to end up blank or not working... I'm sure its something simple I've overlooked.

[manix]

Try having just this

 

$rs = mysql_query($sql);

 

sometimes the second parameter has been an issue in my practice and it's not really that necessary I guess.

 

ALSO don't do that

 

$sql = "select * from users where user = '$user' and pass = '$pass';";

 

Instead have this

 

$sql = "select * from users where user = '$user';"

 

assuming your usernames are escaped and then fetch the array checking the password

[TeNDoLLA]

$sql = "select * from users where user = '$user';"

 

More like should be

$sql = "select * from users where user = '$user'";

 

You gonna need that semicolon in the end of you will get parse error from PHP.

[skwap]

Try below code

 

 

<?php
error_reporting(0);
session_start(); 

// Connects to the database
require 'database.php';
$db = mysql_connect( "$location", "$dbuser", "$dbpass" );
mysql_select_db( "$database" );
if (!isset($_SESSION['log'])) {
  $bads = array("'","<",">",",","$",";",":",".");
  $user = $_POST['user'];
  $user = str_replace($bads,"",$user);
  $pass = $_POST['pass'];
  $pass = str_replace($bads,"",$pass);
  $pass = md5($pass);
  if(isset($user) & isset($pass) & ctype_alnum($user)) {
  $sql = mysql_num_rows(mysql_query("SELECT * FROM `users` WHERE `user` = '$user' AND `pass` = '$pass'"));
  if($sql > "0") {
    $_SESSION['log'] = $user;
    break;
   }
   else {
    echo "Wrong username or password, please try again!";
    mysql_close();
   }
  }
  ?>
  <H2 ALIGN="CENTER">Roleplay Login</H2>
  <FORM ACTION="index.php" METHOD="POST">
   <TABLE WIDTH="200" BORDER="0" ALIGN="CENTER">
    <TR>
     <TD>Username</TD>
     <TD WIDTH="105"><INPUT NAME="user" TYPE="text" SIZE="15"></TD>
    </TR>
    <TR>
     <TD>Password</TD>
     <TD WIDTH="105"><INPUT NAME="pass" TYPE="PASSWORD" SIZE="15"></TD>
    </TR>
    <TR>
     <TD COLSPAN="2"><DIV ALIGN="CENTER"><INPUT TYPE="submit" VALUE="Login"></TD>
    </TR>
   </TABLE>
  </FORM>
  <?
}
if (isset($_SESSION['log'])) {

}
?>

[radiations3]

You won't get any login issues if you use DREAMWEAVER...

[ThE_GuN]

Okay, thanks for all the help... as I said I had a feeling it was something really silly... and it was... I added:

 

if (!$db) {

    die('Could not connect: ' . mysql_error());

}

 

to my connection... and the problem was that I hadn't managed to get a connection to the database... mostly because the host used a diffrent internal address for the sql server... so localhost didn't work as I'm used to.