[SOLVED] Help debugging this login script

[Trium918]

Problem: Implement a script that will log the user

in to members.php. The database column are user_name

and password.

 

user_name = User1

password = great123

 

From some reason I am getting the

// unsuccessful login else statement

could someone explain to me what would

cause this?

 

<form method="post" action="member.php">
Username:
<input class="post" type="text" name="user_name"  />
Password:
<input class="post" type="password" name="password"  />
<input type=submit value=Login />

 

<?php
session_start();
  
if ($_POST['user_name'] && $_POST['password'])
// they have just tried logging in
{
    if (login($user_name, $password))
    {
      // if they are in the database register the user id
      $valid_user = $user_name;
      $_SESSION['valid_user'] = $valid_user; // instead of session_register("valid_user");
    }  
    else
    {
      // unsuccessful login
      do_html_header("Problem:");
      echo "<p class='genmed'>You could not be logged in. 
      You must be logged in to view this page.</p>";  
      do_html_url("index.php", "Login");
      do_html_footer();
      exit;
    }      
}
?>

 

if (login($user_name, $password)) function

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
  // connect to db
  $conn = db_connect();
  if (!$conn)
    return 0;

  // check if username is unique
  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')");
  if (!$result)
     return 0;
  
  if (mysql_num_rows($result)>0)
     return 1;
  else 
     return 0;
}
?>

 

If successful display member content

 

[Trium918]

This function is returning zero.

I donnot understand this because

every is connected to the same database.

 

<?php
// check if username is unique
  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')");
  if (!$result)//why would this return zero?
     return 0;
  
  if (mysql_num_rows($result)>0)
     return 1;
  else 
     return 0; 
?>

[Trium918]

Would someone take a look at code?

Thanks.

[MadTechie]

ok i'll point it out...

 

try setting the varibles $user_name & $password

also use isset

 

quick update...

 

<?php
if (isset($_POST['user_name']) && isset($_POST['password']))
// they have just tried logging in
{
$user_name= $_POST['user_name'];
$password = $_POST['password'];

    if (login($user_name, $password))

?>

 

 

**i only reviewed the start of the code

*update is untested

 

 

EDIT: Added <?php marks

[MadTechie]

oh as a side note,

 

#1 password shoudn't be stored as clear text

#2 that script is open to SQL injection

[Trium918]

Thanks MadTechie, but I tried that. I have every

variable initialized in another file.

 

The problem is here inside the login()function, but I cannot figure it out. May you can.

Its returning zero. I tested it by doing this if (login($user_name, $password ==0))

and it went through.

 

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
 // connect to db
 $conn = db_connect();
 if (!$conn)
   return 0;

 // check if username is unique
 $result = mysql_query("select * from members_info 
                        where user_name='$user_name'
                        and password = password('$password')");
 if (!$result)
    return 0;
 
 if (mysql_num_rows($result)>0)
    return 1;
 else 
    return 0;
}
?>

[Trium918]

oh as a side note,

 

#1 password shoudn't be stored as clear text

#2 that script is open to SQL injection

 

Point the script out please.

[MadTechie]

Try

 

#1 append the echo and die;

<?php

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
  // connect to db
echo "$user_name - $password";
die;

?>

 

 

[Trium918]

Try

 

#1 append the echo and die;

<?php

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
  // connect to db
echo "$user_name - $password";
die;

?>

 

 

 

I got User3 - 123456789

[MadTechie]

ok remove the echo and die

 

now (i have to ask) but the password in the database was written via the "Password" function in mysql ?

 

i assume so..

 

ok

 

now

<?php
print_r($result);
die;
  if (!$result)
     return 0;
?>

[Trium918]

ok remove the echo and die

 

now (i have to ask) but the password in the database was written via the "Password" function in mysql ?

 

i assume so..

 

ok

 

now

<?php
print_r($result);
die;
  if (!$result)
     return 0;
?>

 

Result: Resource id #14

yes

password('$password')

[chrisv]

Might be too simple, but if you have every variable defined in another file, are the variables declare global in the function scope for login()?

 

UPDATE - Nevermind.  It's late on a Friday, and I missed the function arguments.

 

Chris

[MadTechie]

LOL

 

you are not fetching the data

 

try

<?php

  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')");

$row = mysql_fetch_array($result) or die(mysql_error());
print_r($row);
?>

 

not sure how i missed that

[Trium918]

LOL

 

you are not fetching the data

 

try

<?php

  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')");

$row = mysql_fetch_array($result) or die(mysql_error());
print_r($row);
?>

 

not sure how i missed that

 

Result = a blank screen

[MadTechie]

???  erm you should get array() atleast!

 

comment out the

 

<?php
//  if (!$conn)
//    return 0;
?>

 

 

[Trium918]

???  erm you should get array() atleast!

 

comment out the

 

<?php
//  if (!$conn)
//    return 0;
?>

 

 

<?php

  /* if (!$conn)
    return 0;*/

// and this 

/* $conn = db_connect();
  if (!$conn)
    return 0;*/
?>

 

Result = blank screen

 

That is what I donnot understand because I have

another function that is unsing the same type of

connection and it works. I not even getting an error

from the mysql_error(). Wierd

 

[MadTechie]

ok from the top now

 

 

of course add the USER, PASS, HOST & DATABASE

 

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
  // connect to db
// $conn = db_connect();

        $id = @mysql_pconnect("HOST", "USER", "PASS") or
            MySQL_ErrorMsg("Unable to connect to MySQL server");
@mysql_select_db("DATABASE", $id) or
            MySQL_ErrorMsg ("Unable to select database");


  // check if username is unique
  $result = mysql_query("select * from members_info", $id) or
            MySQL_ErrorMsg ("Unable to perform query: $query");

$row = mysql_fetch_array($result,MYSQL_NUM) or die(mysql_error());
print_r($row);
}
?>

[Trium918]

ok from the top now

 

 

of course add the USER, PASS, HOST & DATABASE

 

<?php
function login($user_name, $password)
// check username and password with db
// if yes, return true
// else return false
{
  // connect to db
// $conn = db_connect();

        $id = @mysql_pconnect("localhost") or
            MySQL_ErrorMsg("Unable to connect to MySQL server");
@mysql_select_db("members_database", $id) or
            MySQL_ErrorMsg ("Unable to select database");


  // check if username is unique
  $result = mysql_query("select * from members_info", $id) or
            MySQL_ErrorMsg ("Unable to perform query: $query");

$row = mysql_fetch_array($result,MYSQL_NUM) or die(mysql_error());
print_r($row);
}
?>

 

Result = Array ( [0] => 1 [1] => User1 [2] => First Name [3] => Last Name [4] => male [5] => 1 [6] => 1 [7] => 1985 [8] => 8645383378 [9] => [10] => 2007-04-20 17:17:11 [11] => 02e630bf4b772bf )

[MadTechie]

Woohoo

 

OK

 

change

<?php
  $result = mysql_query("select * from members_info", $id) or
?>

 

to

<?php
  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')", $id) or
?>

 

 

retest

[Trium918]

Woohoo

 

OK

 

change

<?php
  $result = mysql_query("select * from members_info", $id) or
?>

 

to

<?php
  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')", $id) or
?>

 

retest

 

Result = echo "<p class='genmed'>You could not be logged in.

            You must be logged in to view this page.</p>";

 

<?php
else
    {
      // unsuccessful login
      do_html_header("Problem:");
      echo "<p class='genmed'>You could not be logged in. 
            You must be logged in to view this page.</p>";
  echo "<p class='genmed'> $user_name $password</p>";
      do_html_url("index.php", "Login");
      do_html_footer();
      exit;
    }      
?>

[MadTechie]

OK almost done

 

change

<?php

$row = mysql_fetch_array($result,MYSQL_NUM) or die(mysql_error());
//print_r($row);
return (mysql_num_rows($result)>0); // <--Add this
?>

[Trium918]

OK almost done

 

change

<?php

$row = mysql_fetch_array($result,MYSQL_NUM) or die(mysql_error());
//print_r($row);
return (mysql_num_rows($result)>0); // <--Add this
?>

 

Same Result = echo "<p class='genmed'>You could not be logged in.

            You must be logged in to view this page.</p>";

 

 

[MadTechie]

<?php

$row = mysql_fetch_array($result,MYSQL_NUM) or die(mysql_error());
print_r($row); // <--Add back inn
die; // <--Add
return (mysql_num_rows($result)>0); // <--Add this
?>

[Trium918]

Result = blank page again

 

There is no data being pulled from the query. Do you agree?

<?php

  // check if username is unique
  $result = mysql_query("select * from members_info 
                         where user_name='$user_name'
                         and password = password('$password')", $id);
?>

[MadTechie]

i do..

 

#1 remove the "and password = password('$password')"

 

#2 if #1 works check the entry in the database (try updating it) if not check the username

 

i am signing out at it 4am and i need sleep

 

good luck