[SOLVED] problems with login script

[wikedawsum]

Hello all. I'm having some serious problems and cannot figure out what is going on. I've created a simple login script so I can check connections to my database, etc.. (been having problems for a while and am doing this to narrow them down).

My login form is as follows:

[code]<form name="authenticate" method="post" action="login.php">
<input name="username" type="text" value="username" size="20"/><br>
<input name="passwd" type="text" value="passwd" size="20"/><br>
<input type="submit" name="submit" value="submit"/>
<input type="reset" name="reset" value="reset"/>
</form>[/code]

login.php:

[code]<?php

@mysql_connect("mysql.aacapartsandsupplies.com", "admin", "******") or die("Cannot connect to DB!");
@mysql_select_db("tokens") or die("Cannot select DB!");
$sql="SELECT username FROM user WHERE username='$username' and passwd=sha1('$passwd')";
$r = mysql_query($sql);
if(!$r) {
$err=mysql_error();
print $err;
exit();
}
if(mysql_affected_rows()==0){
print "no such login in the system. please try again.";
exit();
}
else{
print "successfully logged into system.";
//proceed to perform website’s functionality – e.g. present information to the user
}

?>[/code]

Unless I am missing something, all of this seems to look ok to me. However, when I try to login with my registered username and password, I get the "no such login in the system. please try again" error. What confuses me is that the username IS registered, and I can view that information by visiting [url=http://www.aacapartsandsupplies.com/users.php]http://www.aacapartsandsupplies.com/users.php[/url]. So, if the user is registered, why is it telling me they're NOT registered? If you want to check the form out it's located at [url=http://www.aacapartsandsupplies.com/login.html]http://www.aacapartsandsupplies.com/login.html[/url]. Again, these are just test pages and are not secure or anything. I'm just trying to narrow down my problems.

Hopefully I've explained this well enough. Thanks to anyone who can give me some insight.

[fert]

change
[code]
$r = mysql_query($sql);
[/code]
to
[code]
$r = mysql_query($sql) or die(mysql_error());
[/code]

[wikedawsum]

Thanks for your reply. That did get rid of "no such login...", but it only displays a blank page. It doesn't tell me that I've successfully logged in as it should.

[Asheeown]

[code]
<?php

@mysql_connect("mysql.aacapartsandsupplies.com", "admin", "******") or die("Cannot connect to DB!");
@mysql_select_db("tokens") or die("Cannot select DB!");
$sql="SELECT username FROM user WHERE username='$username' and passwd=sha1('$passwd')";
$r = mysql_query($sql);
if(!$r) {
$err=mysql_error();
print $err;
exit();
}
if(mysql_affected_rows()==0){
print "no such login in the system. please try again.";
exit();
}
else{
print "successfully logged into system.";
//proceed to perform website’s functionality – e.g. present information to the user
}

?>
[/code]
should have to change

if(mysql_affected_rows()==0){

if im not mistaken
because then mysql_affected_rows has no array to actually look for so it should be

if(mysql_affected_rows($sql)==0){

If you just have a white screen it might be an error that your not seeing take out the die part and see if it works

[wikedawsum]

Fearsolider, tried using your suggestion..

[code]<?php

@mysql_connect("mysql.aacapartsandsupplies.com", "admin", "bc5106") or die("Cannot connect to DB!");
@mysql_select_db("tokens") or die("Cannot select DB!");
$sql="SELECT username FROM user WHERE username='$username' and passwd=sha1('$passwd')";
$r = mysql_query($sql);
if(!$r) {
$err=mysql_error();
print $err;
exit();
}
if(mysql_affected_rows($sql)==0){
print "no such login in the system. please try again.";
exit();
}
else{
print "successfully logged into system.";
//proceed to perform website’s functionality – e.g. present information to the user
}

?>[/code]

Received this error:

Warning: mysql_affected_rows(): supplied argument is not a valid MySQL-Link resource in /home/.doris/aacatest/test.aacapartsandsupplies.com/members/login.php on line 12
no such login in the system. please try again.

[High_-_Tek]

That implies that the query you used is not valid, although it should show up in an mysql_error()

[fert]

whoops
I posted my code wrong
I meant to say
Change
[code]
$r = mysql_query($sql);
[/code]
to
[code]
$r = @mysql_query($sql) or die(mysql_error());
[/code]
and
change
[code]
if(mysql_affected_rows($sql)==0){
[/code]
to
[code]
if(mysql_affected_rows($r)==0){
[/code]

[wikedawsum]

[quote]whoops
I posted my code wrong
I meant to say
Change

Code:
$r = mysql_query($sql);
to

Code:
$r = @mysql_query($sql) or die(mysql_error());
and
change

Code:
if(mysql_affected_rows($sql)==0){
to

Code:
if(mysql_affected_rows($r)==0){[/quote]

That gave me the same error.


[quote]That implies that the query you used is not valid, although it should show up in an mysql_error()[/quote]

I'm not sure how my query could be wrong.. I have a database named tokens with a table named user. username and passwd are two of the fields in the table. Not sure what could be wrong with the query.

[fert]

try this:
change
[code]
$sql="SELECT username FROM user WHERE username='$username' and passwd=sha1('$passwd')";
[/code]
to
[code]
$password=sha1($password);
$sql="SELECT username FROM user WHERE username='$username' and passwd='$password'";
[/code]

[wikedawsum]

No luck. Still saying I'm not registered. I tried creating a new database thinking perhaps I had setup something wrong in the original one. That didn't help. I have used databases with login scripts on this site before and they have worked fine. I'm about ready to pull my hair out!

[HuggieBear]

You're using the wrong function... [color=red]mysql_affected_rows()[/color] only works after INSERT, UPDATE, REPLACE or DELETE statements.  For SELECT statements you want to use [color=blue]mysql_num_rows()[/color]

Use this:

[code]<?php
// Connect to db
@mysql_connect("mysql.aacapartsandsupplies.com", "admin", "******") or die("Cannot connect to DB!");

// Select db
@mysql_select_db("tokens") or die("Cannot select DB!");

// Run query
$sql = "SELECT username FROM user WHERE username='$username' and passwd=sha1('$passwd')";
$r = mysql_query($sql);
if(!$r){
  $err=mysql_error();
  echo $err;
  exit();
}

// Check if user exists
if(mysql_num_rows() == 0){
  echo "no such login in the system. please try again.";
  exit();
}
else{
  echo "successfully logged into system.";
  // present information to the user
}
?>[/code]

Regards
Huggie

[wikedawsum]

Thank you, HuggieBear! That got it working.

I did have to change

[quote]if(mysql_num_rows() == 0){[/quote]

to

[quote]if(mysql_num_rows($r) > 0){[/quote]

Thank you everyone for input and suggestions!

[HuggieBear]

Oh yeah, sorry, I missed out your result resource.  That's copying and pasting for you :)

Regards
Huggie