how to echo properly in a mysql statement

[droidus]

i have this mysql code, and am not sure how to properly echo the md5 when needed:

 

mysql_select_db($database_uploader, $uploader);    
      	$query = "SELECT * FROM members WHERE uname='"
        . mysql_real_escape_string($loginUsername) . 
	"' AND pword='" . if(!isset($_SESSION['remember_me_check'])) { echo "md5"; } (mysql_real_escape_string($loginPassword)) . "'";  

 

the reason i'm doing this, is because if the user selects "remember me", i save the password (md5) to a cookie, then just use that to login along with their username to log them in.

[MasterACE14]

I'm really not sure what you're trying to do with your code...

$query = "SELECT * FROM members WHERE uname='"
        . mysql_real_escape_string($loginUsername) . 
	"' AND pword='" . md5(mysql_real_escape_string($loginPassword)) . "'";  

[cunoodle2]

echo $query;

 

???

[droidus]

if the user checks "remember me", i want to set the password, but i don't want anybody to be able to actually see that password, so i use md5 on it to scramble it.  then they login with this, since you can't unscramble an md5.  so, either the password will be 1234, or t5gt.  if the cookies are set, i have to not use md5, since it is already in that format.  in my database, my passwords have md5 already applied to them.  do you know what i mean now?

[TeNDoLLA]

I'm really not sure what you're trying to do with your code...

$query = "SELECT * FROM members WHERE uname='"
        . mysql_real_escape_string($loginUsername) . 
	"' AND pword='" . md5(mysql_real_escape_string($loginPassword)) . "'";  

 

This is the solution

[droidus]

ok, but what if the password is already in md5 format?  wouldn't it md5 the md5 then?

[iStriide]

Well I guess if people are logging in with their already md5'ed password then it wouldn't need to be md5'ed again, but if people are just logging  in with their normal password (Ex: Password: mypassword00) then it would need to md5'ed to find it in the query.

 

I think it is how md5 works. Not sure if it just generates a random mumbo jumbo of letters, but I think that is how it goes.

[droidus]

ok, so that is why the md5 needs to be echoed, on the condition of whether the cookie is set or not.  so maybe i should do..

 

if cookie is already set, do not use md5 (then query...)

if cookie is not set, md5 the password (then query...)

 

here is what i was looking for:

 

if (!$blank_fields) {

if(isset($_SESSION['remember_me_check'])) {

mysql_select_db($database_uploader, $uploader);   

      $query = "SELECT * FROM members WHERE uname='"

        . mysql_real_escape_string($loginUsername) .

"' AND pword='" . (mysql_real_escape_string($loginPassword)) . "'"; 

      $result = mysql_query($query) or die(mysql_error());

} else {

mysql_select_db($database_uploader, $uploader);   

      $query = "SELECT * FROM members WHERE uname='"

        . mysql_real_escape_string($loginUsername) .

"' AND pword='" . md5((mysql_real_escape_string($loginPassword))) . "'"; 

      $result = mysql_query($query) or die(mysql_error());

}