User login and registration system

[jaymeh]

Hi All,

 

I have currently been working on a login/registration system for a university project and I am now struggling with the login section. The problem is with one particular function and an if statement. The function checks to see if the username and password entered matches the username and password in the database but each time I get it echoing username/password incorrect.

 

the function is

function valid_credentials($user, $pass)
{
$user = mysql_real_escape_string($user);
$pass = sha1($pass);

$total = mysql_query("SELECT COUNT(`user_username`) FROM `users` WHERE `user_username` = '{$user}' AND `user_password` = '{$pass}'");

return (mysql_result($total, 0) == '1') ? true : false;
}

 

and the statement is

if (valid_credentials($_POST['username'], $_POST['password']) == false)
{
	$errors = 'Username/Password incorrect.';		
}

 

Any help would be greatly appreciated as this has been bugging me for the past 5 days :/

[litebearer]

IF you are using unique id's, might try...

 

function valid_credentials($user, $pass) {
$user = mysql_real_escape_string($user);
$pass1 = sha1($pass);
$query = "SELECT id FROM users WHERE user_username = '$user' AND user_password =  '$pass1'";
$result = mysql_query($query);
if(mysql_num_rows($result)>0) {
	$row = mysql_fetch_array($result);
	return $row['id'];
}else(
	return 0;
)
}

if function returns 0 then no match; otherwise the value will be the id of the match.

 

[PFMaBiSmAd]

There's close to a dozen different things that could prevent your code from working, from invalid HTML in your form all the way to a database field that is not long enough to hold a sha1 value.

 

What have you done to narrow down exactly at what point the code, data values, and query that you posted are doing what you expect and exactly at what point they are not? I can guarantee that the problem lies between those two points.

 

Have you checked if $user and $pass values you are putting into the query statement have the values you expect and exactly match a row in your database table? Have you checked if the mysql_query statement is returning a false value (the query failed due to an error of some kind, such as an incorrect column name) or if it is returning a result resource (the query executed without error)? Have you checked what value the mysql_result statement is returning?

 

Short-answer: we don't have access to all your code, your database table definition, the data in your database, or your server. We cannot even tell if the query statement you posted has the correct table and column names in it. After you narrow down the problem to one section of code, you have to check each individual statement/value/query in that section of code to find out what is failing.

[jaymeh]

Thank you both for your help. I figured out the problem. The user_password field was not long enough for the full hash tag.

 

Thanks again

Jamie

[litebearer]

As PFM said, we would need to see more of your relavent code