Issue with MYSQL Query

[n1concepts]

Hi,

 

I am defining a php script to check captured input username and password from a form against a MySQL database and can't get the syntax right - regarding the $_POST['password'] portion of query.

 

Here's the actual php code showing query:

 

//create and issue the query
// $command = "SELECT username FROM agents WHERE username ='".$_POST['username']."';";      // THIS ONE WORKS JUST FINE IF JUST CHECKING USERNAME from DB
$command = "SELECT username FROM agents WHERE username ='".$_POST['username']."' AND password = MD5('".$_POST['password']."');";
echo "Command: ".$command."<br>";
$result = mysql_query($command);
echo "Result: ".$result."<br>";

 

Here's the error I get on the php page when loading and submitting username and password:

 

Command: SELECT username FROM agents WHERE username ='user1' AND password = MD5('pass1234');

Result:

 

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/websited/public_html/projects/forgottenmobile/index.php on line 58

 

Note: line 58 is just checking for:

 

mysql_num_rows($result) == 1;

 

The issue is the query is not correct regarding:

 

password = MD5('pass1234') portion of the SQL string.

I know it's with the location of th single and double quotes but struggling to find the right syntax structure.

 

Can someone advise the correct syntax structure to include MD5 function for the variable '$_POST[password]' in the $command query?

---

 

Note: the password is encrypted using MD5 so that function required in the query.

 

Thx!

[Psycho]

You should check for DB errors and provide a means to see the errors. In a dev environment you can just do this:

$result = mysql_query($command) or die(mysql_error());

 

I don't see anything wrong with the syntax of your query. Although you don't need the semi-colon at the end of the query, but I don't think that will cause an error. Could be you have a typo in the field names. Runt he above to see what the actual error is.

[n1concepts]

Thanks for checking and I should have done that (dope!) to see issue.

Soon as I modify the string to see myslerror, it was PLAIN as day!

 

I didn't close the mysql connection (intentionally) and when I moved the code to another host, db wasn't update in file.

 

thx!