[SOLVED] Error in Logging

[timmah1]

Can someone tell me what I'm doing wrong?

I keep getting this error
[code]
Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in login.php on line 39
[/code]

This is line 39
[code]
while($row = mysql_fetch_array($result)){
[/code]

and this is the entire code
[code]
if (!isset($username) || !isset($password)) {
header( "Location: http://www.fotobins.com/login.htm" );
}
elseif (empty($username) || empty($password)) {
header( "Location: http://www.fotobins.com/login.htm" );
}
else{
$user = addslashes($_POST['username']);
$pass = md5($_POST['password']);

$dbHost = "localhost";
$dbUser = "xxxx";
$dbPass = "xxxx";
$dbDatabase = "xxxx";

$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
$result=mysql_query("select * from users where username='$user' AND password='$pass'", $db);

$rowCheck = mysql_num_rows($result);
if($rowCheck > 0){
while($row = mysql_fetch_array($result)){

  session_start();
  session_register('username');

    echo "Success!<br><a href=http://www.fotobins.com/$row[username]/myaccount.php>Click here to proceed</a>";
$ip = $REMOTE_ADDR;
$query="update users set last_login=NOW(), last_ip='$ip' where username = '$user'";
$result = MYSQL_QUERY($query);
header( "Location: $username/myaccount.php" );
  }

  }
  else {

  echo 'Incorrect login name or password. Please try again.';
  }
  }
[/code]


Thank you in advance for any help!  :)

[conker87]

"mysql_fetch_array" doesn't support the use of 2 WHERE clauses, I think - it's what I've come to notice anyway.

Try validating the password after, (I've starting editing on line 33):

[code]$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
$result=mysql_query("select * from users where username='$user'", $db);

$rowCheck = mysql_num_rows($result);
if($rowCheck > 0)
{
while($row = mysql_fetch_array($result))
{
if ($pass != $row['<PASSWORD FIELD>'])
{
// Passwords do not match
}
else
{
// Passwords DO match
session_start();
session_register('username');
echo "Success!<br><a href=http://www.fotobins.com/$row[username]/myaccount.php>Click here to proceed</a>";
$ip = $REMOTE_ADDR;
$query="update users set last_login=NOW(), last_ip='$ip' where username = '$user'";
$result = MYSQL_QUERY($query);
header( "Location: $username/myaccount.php" );
}
[/code]

Apologies if I've mucked up your layout of your code, I have difficulty reading code if I don't organise it into my own way before I read it.

[alpine]

[quote]"mysql_fetch_array" doesn't support the use of 2 WHERE clauses[/quote]
yes it does

Try to backtick password in particular since it's a reserved word in mysql + add "or die(mysql_error())" and see what the fairy tells you:
[code]

<?php

$result = mysql_query("select * from users where `username`='$user' AND `password`='$pass'") or die(mysql_error());

?>

[/code]

[timmah1]

Thanks for the replies, but it turned out to be something else in general.

One more question, how, after someone logs in, can have it automatically forward the user to their page?

Right now, I just have a link for them to click to get to thier page
[code]
echo "Success!<br><a href=http://www.fotobins.com/$row[username]/myaccount.php>Click here to proceed</a>";
[/code]

And I also have a header tag, but that's giving me errors also
[code]
header( "Location: $username/myaccount.php" );
[/code]

Any idea?

[alpine]

To use header you cannot output anything at all to the browser before header is used.

An alternative is meta refresh (0 is instant, 5 is 5 seconds etc)
[code]
<?php

echo <<<_HTML

<meta http-equiv="refresh" content="5; url=http://www.fotobins.com/{$row[username]}/myaccount.php" />

Succsess!
<br />
You will be redirected in 5 sec's or simply <a href="http://www.fotobins.com/{$row[username]}/myaccount.php">click here</a>

_HTML;

?>
[/code]

[timmah1]

PREFECT!!!
thank you.

I knew about the redirect, I just wasn't real sure on where to put it.

Thank you once again!!!