[SOLVED] user authentication error

[runnerjp]

hey guys... i have got a script that enables users to "activate" their accounts....this is how its done...

 

an email is sent out to them asking them to click a link

$sql = "INSERT INTO $tbl_members (login, enabled, password, email, displayname, newsletter, ipaddr)
VALUES (\"$login\", \"no\",*the no represents the enable* \"$pass1\", \"$email\", \"$displayname\", \"$newsletter\", \"$ipaddr\")";
$result = @mysql_query($sql,$connection) or die("<b>A fatal MySQL error occured</b>.\n<br />Query: " . $query . "<br />\nError: (" . mysql_errno() . ") " . mysql_error());

if($mailonnew == "yes") {
$to = "$site_email";
$subject = "New $sitename Member!";
$from_mail = "$adminemail";
$message = "Dear Admin,\n\n";
$message .= "You have a new member with the login: $login.\n\n";
$message .= "$siteurl";
$headers = "From: $from_mail\r\n";
$headers .= "Reply-To: $from_mail\r\n";
$headers .= "X-Mailer: phpProfiles";
mail($to, $subject, $message, $headers);
}
$to = "$email";
$subject = "New $sitename Member!";
$from_mail = "$adminemail";
$message = "Dear $displayname";
$message="<a href='http://www.runnerselite.com/include/reg_success.inc.php?login=".$login."&enabled=yes'>Please click to confirm</a>"; //here being the link
$message .= "$siteurl";
$headers = "From: $from_mail\r\n";
mail($to, $subject, $message, $headers);
include("index.php");
?>

 

once the user clicks on the link they are re-directed to this page

<?php 

$connection = @mysql_connect("localhost", "username", "password") or die("Couldn't connect.");
$db = @mysql_select_db(runnerse_profiles) or die("Couldn't select database.");


if(isset($_GET["login"]))
{
$login=$_GET["login"];
$password=$_GET["password"];
$enabled=$_GET["enabled"];
}

$res=mysql_query("update $tbl_members set enabled='yes' where login='$login' ");
?>

<p>thankyou! </p>

 

ok basicly the code does not enable the user they are still listed as no... how comes it does not work ?

what needs to be done?

 

thanks

[runnerjp]

?

[runnerjp]

any 1 online who can help today

[Fehnris]

So the code line '$res=mysql_query("update $tbl_members set enabled='yes' where login='$login' ");' isnt updating the database record for the current user? Try putting 'or die("MYSQL update error.".mysql_error());' at the end of the line to see if you get an error for the mysql_query. If its not updating the current users database record, its more than like going to be the update query that isnt working correctly.  By putting the or die statement at the end, you will be able to find out why the query isnt working.

 

[runnerjp]

ok :S i got this

MYSQL update error.You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'set enabled='yes' where login='123'' at line 1

what does that mean lol and how do i solve it ty

[bsprogs]

ok :S i got this

MYSQL update error.You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'set enabled='yes' where login='123'' at line 1

what does that mean lol and how do i solve it thank you

 

That generally means your error will be rigth before set enabled='yes'

 

Try taking the $ out of $tbl_members - I'm guessing that "tbl_members" is your table name?

[runnerjp]

ok i says ".Table 'runnerse_profiles.tbl_members' doesn't exist" yet it does!! whyyy lol have i still got something wrong :S

[bsprogs]

Can you show me the code for the query? I'll see if I can help you ge this before I go to bed

[runnerjp]

why ty

 

here is the code thats sent in email

 

$message="<a href='http://www.runnerselite.com/include/reg_success.inc.php?login=".$login."&enabled=yes'>Please click to confirm</a>"; 

 

 

and this is code that is producing the error

 

<?php 

$connection = @mysql_connect("localhost", "USERNAME", "PASSWORD") or die("Couldn't connect.");
$db = @mysql_select_db(runnerse_profiles) or die("Couldn't select database.");


if(isset($_GET["login"]))
{
$login=$_GET["login"];
$password=$_GET["password"];
$enabled=$_GET["enabled"];
}

$res=mysql_query("update tbl_members set enabled='yes' where login='$login' ")or die("MYSQL update error.".mysql_error());
?>

 

its the last part that is producing the error but iu thought i would post it all incase it is sum where else

[bsprogs]

I dont really see anything wrong with the query

 

The only other thing I can think of is that the table name is just "members." Double check the table name. If you can, copy and paste it in the code.

 

One tip that I've always followed and have been told it's a good habit is to use caps when inserting SQL code

example:

$res=mysql_query("UPDATE tbl_members SET enabled='yes' WHERE login='$login' ")or die("MYSQL update error.".mysql_error());

 

 

One more thing: Do you want the code to try to update the table in the database if $_GET['login'] was not supplied?

[runnerjp]

i dunno what do u suggest??

 

"i want it so a user can only activate" the account 1ns they have clicked the link sent in the email... so this way i can makle sure that the users email is correct and stop bots ect...

[runnerjp]

wahooo it works!!!

 

all i did was copy wat u put and pasted it in :S all that was changed was the caps!

 

wierd

[bsprogs]

Glad you got it working

 

Dont forget to mark this thread as solved!

[runnerjp]

ty so much for stayin up 2 help lol!!

 

btw wat did u mean by

One more thing: Do you want the code to try to update the table in the database if $_GET['login'] was not supplied?

[bsprogs]

thank you so much for stayin up 2 help lol!!

 

btw wat did u mean by

One more thing: Do you want the code to try to update the table in the database if $_GET['login'] was not supplied?

 

What I meant by that is, the way you have the code setup now, whether or not $_GET['login'] is set, the website will execute the UPDATE query. If you only want the page to use the UPDATE query, you would want to stick the query inside the if statement.

[runnerjp]

ah ok i get you...i will change that now then ty

[Fehnris]

Sorry for the late response, havent been arround all day.  Glad you got it working