Update database

[cmb]

I'm not shore what to do this update code isn't updating my database this is just the update code for my login

mysql_query("UPDATE users SET session_id='$session' WHERE email='$email' AND password='$pas'") or die(mysql_error()); //Add session ID to DB
mysql_query("UPDATE users SET login_ip='$ip' WHERE email='$email' AND password='$pas'") or die(mysql_error()); //Add login IP to DB

and this is all of it

<title>Log In</title><?php
require('database.php'); //Include DB connection information

if (isset($_POST['login'])) { //Execute the following if form is submitted
$ip = mysql_real_escape_string($_SERVER["REMOTE_ADDR"]); //Geet user's IP Address
$email = mysql_real_escape_string($_POST['email']); //Post email from form
$password = mysql_real_escape_string(sha1(md5($_POST['pass']))); //Post password from form and encrypt

if (empty($email) || empty($password)) { //Check for empty fields
die("<b>Error:</b> All fields are required to be filled in.");
}

$check = mysql_query("SELECT * FROM users WHERE email = '$email'") or die(mysql_error());
$check2 = mysql_num_rows($check);
if ($check2 == 0) { //Check if account exists
die("<b>Error:</b> Email and password do not match the database.");
}
$row = mysql_fetch_array($check);
$db_password = $row['password']+$row['key'];
if ($password != $db_password) { //Check if password is correct
die("<b>Error:</b> Email and password do not match the database.");
}

$allowed = $row['u'];
if ($allowed != 1) { //Check if they have permission
die("<b>Error:</b> You do not have permission to view this section.");
}

function randomstring($length = 10) {
    $validCharacters = "abcdefghijklmnopqrstuxyvwz1234567890";
    $validCharNumber = strlen($validCharacters);

    $result = "";

    for ($i = 0; $i < $length; $i++) {
        $index = mt_rand(0, $validCharNumber - 1);
        $result .= $validCharacters[$index];
    }

    return $result;


}
$session = randomstring();
$key = $row['key'];
$pas = $password . $key;

mysql_query("UPDATE users SET session_id='$session' WHERE email='$email' AND password='$pas'") or die(mysql_error()); //Add session ID to DB
mysql_query("UPDATE users SET login_ip='$ip' WHERE email='$email' AND password='$pas'") or die(mysql_error()); //Add login IP to DB

$level = $row['accounttype'];
$u = $row['u'];
$fs = $row['fs'];
$bc = $row['bc'];
$fam = $row['fam'];
$future = time() + 1209600;
setcookie("uemail", $email, $future); //Set cookie containing username
setcookie("sessionid", $session, $future); //Set cookie containging session ID
setcookie("acounttype", $level, $future);
setcookie("u", $u, $future);
setcookie("fs", $fs, $future);
setcookie("bc", $bc, $future);
setcookie("fam", $fam, $future);
//////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////
//header("Location: undefined.php"); //Redirect to members page

}
else
{ //If form is not submitted display the form
echo<<<login
<center>
<h1>Log In To The Undefiend Section</h1>
<h2>Or GO <a href="../main.php">Home</a></h2>
<form method="post" action="">
Email: <input type="text" name="email"><br>
Password: <input type="password" name="pass"><br>
<input type="submit" name="login" value="Login"><br><br>

</form></center>
login;
}
?>

[MasterACE14]

this...

$db_password = $row['password']+$row['key'];

should be this...

$db_password = $row['password'] . $row['key'];

combining the strings, rather than trying to 'add' them.

[cmb]

no that wasn't it because when i did that it just gives me the password doesn't match the database error the + works

[MasterACE14]

is a MySQL error coming up?

[cmb]

nope

[MasterACE14]

I don't think one of the(maybe more) values in your WHERE clause are what they should be. Echo them out.

[cmb]

i echoed $session $email $pas $ip $password and $key and everything is coming out correctly

[MasterACE14]

if they were correct, your queries would be working. Have you tried running your queries in PHPMyAdmin?

[cmb]

Ya and it works i tried a INSERT INTO query instead of the UPDATE one and that didn't work either

[Pikachu2000]

Echo your UPDATE query strings and compare the values in it to what actually exists in the database, especially the password field. I'm betting the values don't match.

[cmb]

Im very sorry to have wasted your time you were correct with the password not matching in the update query thank you for your help