ryeman98 Posted July 16, 2007 Share Posted July 16, 2007 Hello! I'm currently working on my first ever User System and I need a bit of help. The login and everything used to work until I moved these down from above the header. I moved them below the header so that the error messages (if any while logging in) will be displayed within the body rather than at the top of the page where they're hard to be seen. <?php $username = $_POST['username']; $password = $_POST['password']; $GetInfo = mysql_query("SELECT * FROM users WHERE username='$username'"); $row = mysql_fetch_array($GetInfo); if ($username != $row['username']) { echo "The username ".$username." is not in our database."; } elseif ($password != $row['password']) { echo "You have entered the wrong password for the account: ".$username."."; } else { $_SESSION['username'] = $username; $_SESSION['rank'] = $row['rank']; } ?> Welcome <?php if ($_SESSION['username']) { echo $_SESSION['username']; } else { echo "Guest"; } ?>! <br /> <a href="logout.php">Logout</a></div></div> This will display: The username *** is not in our database. Welcome Guest! The *** is just removing the username... Any ideas? Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 I thought I should say... the login info. is correct... Quote Link to comment Share on other sites More sharing options...
pocobueno1388 Posted July 16, 2007 Share Posted July 16, 2007 Why are you wanting to say "Welcome Guest" if they get the wrong username/password? Try something like this: <?php $username = $_POST['username']; $password = $_POST['password']; $GetInfo = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); if (mysql_num_rows($GetInfo) < 1) { echo "You entered the wrong username/password combonation"; } else { $_SESSION['username'] = $username; $_SESSION['rank'] = $row['rank']; echo "Welcome {$_SESSION['username']}!"; echo '<br /><a href="logout.php">Logout</a></div></div>'; } ?> Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 You entered the wrong username/password combonation I entered in the correct info... :-\ Quote Link to comment Share on other sites More sharing options...
pocobueno1388 Posted July 16, 2007 Share Posted July 16, 2007 Did you try my code and see if it worked if you entered the right info? Quote Link to comment Share on other sites More sharing options...
ss32 Posted July 16, 2007 Share Posted July 16, 2007 you omitted session_start()... and you want to check both the username and the password in the mysql query, and then check if the size of the result is greater than zero. session_start(); $sql = sprintf("select null from users where username='%s' and password='%s' limit 1", mysql_real_escape_string($_POST['username']), md5($_POST['password'])); $num = mysql_num_rows(mysql_query($sql)); if ($num > 0) { ...store the user into session data... }else{ $errmsg = "username/password combination invalid"; } ...later... if ($errmsg) { echo $errmsg; } Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 Did you try my code and see if it worked if you entered the right info? Yeah... and that's why I'm confused... everything looks right and it worked fine until I moved the code from above the include("header.php")... Can I set a session after the <html> tag? Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 you omitted session_start()... and you want to check both the username and the password in the mysql query, and then check if the size of the result is greater than zero. session_start(); $sql = sprintf("select null from users where username='%s' and password='%s' limit 1", mysql_real_escape_string($_POST['username']), md5($_POST['password'])); $num = mysql_query($sql); if ($num > 0) { ...store the user into session data... }else{ $errmsg = "username/password combination invalid"; } ...later... if ($errmsg) { echo $errmsg; } I just didn't post the entire code... it's a bit messy right now Quote Link to comment Share on other sites More sharing options...
ss32 Posted July 16, 2007 Share Posted July 16, 2007 ok... did you encrypt the password? Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 ok... did you encrypt the password? Yeah... I thought of that being a problem while logging in... Quote Link to comment Share on other sites More sharing options...
ss32 Posted July 16, 2007 Share Posted July 16, 2007 ok, then why arent you checking for the encrypted password? md5(pass) != pass furthermore, it worries me that it isnt finding the user. are you ABSOLUTELY sure that your login info is correct? are you sure that there isnt a mysql_error()? id run some debug to see what $row['username'] actually contains (= heck, id even try and see what $_POST['username'] contains. you may be sending flawed data for all you know. Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 So I echoed out all the info that I was sending and it's all correct... Quote Link to comment Share on other sites More sharing options...
pocobueno1388 Posted July 16, 2007 Share Posted July 16, 2007 Did you change the password so it is checking for the encrypted one? Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 Did you change the password so it is checking for the encrypted one? Yup... :-\ Quote Link to comment Share on other sites More sharing options...
ss32 Posted July 16, 2007 Share Posted July 16, 2007 So I echoed out all the info that I was sending and it's all correct... even the data from the table? can you check that your username and password is still intact in the table? the thing is, that except for the fact that you arent escaping the username string, the query looks fine. I suspect that there may be something above the header line that the code must have been looking for that got reset or something. Quote Link to comment Share on other sites More sharing options...
ryeman98 Posted July 16, 2007 Author Share Posted July 16, 2007 I got it working. As it appears, config.php was in the wrong place and wasn't being called... which is kind of odd... Thanks for all of the help! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.