Login Script error

[wareez]

Someone should please help me with this, i created this login script for Admin and Customer login based on
the type of radio button choosed.

But i dont knwo what the error is, i always get wrong user name and password but if i register it submit to the
database but to login with my details continue to give wrong username and password. I have even tried it on my
easyphp server it work fine, but when i uploaded it to the website online, i keep on getting wrong username and
passwpord.

Please, brother, sisters, friends, senior and whoever can help me you kindly do it.

You can send your correct script to me, my email is jimohwareez@gmail.com
Below is the script:

<?php
$username=$_POST['UserName'];
$password=$_POST['Password'];
$usertype=$_POST['rdType'];
if($usertype=="Admin")
{
$con = mysql_connect("localhost","sample_sample","sample");
mysql_select_db("sample_sample", $con);
$sql = "select * from admin_master where txtusername='".$username."' and txtpassword='".$password."'";
$result = mysql_query($sql,$con);
$records = mysql_num_rows($result);
$row = mysql_fetch_array($result);
if ($records==0)
{
echo '<script type="text/javascript">alert("Wrong UserName or Password");window.location=\'index.php\';</script>';
}
else
{
header("location:blend_sample_details_highvertical/index.php");
}
mysql_close($con);
}
else if($usertype=="Customer")
{
$con = mysql_connect("localhost","sample_sample","sample");
mysql_select_db("sample_sample", $con);
$sql = "select * from customer_registration where UserName='".$username."' and Password='".$password."' ";
$result = mysql_query($sql,$con);
$records = mysql_num_rows($result);
$row = mysql_fetch_array($result);
if ($records==0)
{
echo '<script type="text/javascript">alert("Wrong Username or Password");window.location=\'signin.php\';</script>';
}
else
{
$_SESSION['id']=$row['customerid'];
$_SESSION['name']=$row['customername'];
header("location:customer/index.php");
}

}

?>

[cyberRobot]

Do you know if MySQL is throwing errors? Note that you can use mysql_error() to check.

http://php.net/manual/en/function.mysql-error.php

 

Also note that your queries are vulnerable to SQL injection attacks. If you haven't done so already, you'll want to look into mysql_real_escape_string().

http://php.net/manual/en/function.mysql-real-escape-string.php

Edited May 1, 2015 by cyberRobot

[tampaphp]

In your queryies, add a check for mysql_errors())

$result = mysql_query($sql,$con) or die(mysql_errors());