[SOLVED] login not working for unknown reason

quickstopman · December 14, 2007

hi guys i have a login script and some some odd reason it won't log anyone

i always get this "You couldn't be logged in!"

any got any ideas?

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<?
$submit=$_POST['login'];
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
//if submit button is pressed
if ($submit){
if((!$username) || (!$password) || ($username=='') || ($password=='')){
echo'<center>Please enter both - username and password!</center>';        
}
$sql=mysql_query("SELECT * FROM `users` WHERE `email` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());
$c=mysql_num_rows($sql);
if($c>0){
$r=mysql_fetch_array($sql);
$_SESSION['id'] = $r['id'];
$_SESSION['username'] = $r['username'];
header("Refresh: 2; url=home.php");
//else, if there werent any records found show an error and 
//return the user to index.
}else{
echo "<center>You couldn't be logged in!</center>";
}
}
?>
<form action="login.php" method='POST'>
E-Mail: <input type='text' name='username'><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?
include'footer.php';
?>

CMC · December 14, 2007

Is the database row for the hashed password the proper length? It has to be at least 32 characters. I've made that mistake before

quickstopman · December 14, 2007

i have the password field set for 255 chars

im really confused cause this script usually works

Xyphon · December 14, 2007

Check your DB, are the passes encrypted?

quickstopman · December 14, 2007

the password for my test account's password is encrypted in md5

CMC · December 14, 2007

Maybe it's the following:

$sql=mysql_query("SELECT * FROM `users` WHERE `email` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());

In that query you specified the email to be check against for the username, but when your assigning session variables you use the row username.

$_SESSION['username'] = $r['username'];

quickstopman · December 14, 2007

i want them to login in with the email but then get the username because the email can change, but the username can't on my site.

quickstopman · December 14, 2007

bump

and also here is the updated code:

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$submit=$_POST['login'];
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
//if submit button is pressed
if ($submit){
if((!$username) || (!$password) || ($username=='') || ($password=='')){
echo'<center>Please enter both - username and password!</center>';        
}
$sql=mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());
$c=mysql_num_rows($sql);
if($c>0){
$r=mysql_fetch_array($sql);
$_SESSION['id'] = $r['id'];
$_SESSION['username'] = $r['username'];
header("Refresh: 2; url=home.php");
//else, if there werent any records found show an error and 
//return the user to index.
}else{
echo "<center>You couldn't be logged in!</center>";
}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

quickstopman · December 16, 2007

anyone???

teng84 · December 16, 2007

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password))){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	$sql=mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());
	$c=mysql_num_rows($sql);
	if($c>0){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		header("Refresh: 2; url=home.php"); // what is this thing for? 
	}else{
		echo "<center>You couldn't be logged in!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

i tried to format your codes try

quickstopman · December 16, 2007

yeah i still get the same message

"You couldn't be logged in!"

this is really getting quite annoying

teng84 · December 16, 2007

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password))){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	$sql=mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());
	print_r(mysql_fetch_assoc($sql));
	echo 'look here';
	$c=mysql_num_rows($sql);
	if($c>0){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		//header("Refresh: 2; url=home.php"); // what is this thing for? 
		header("location: home.php"); // what is this thing for? 
	}else{
		echo "<center>You couldn't be logged in!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

try that and tell me what happen.. can i see the link of your this page?

quickstopman · December 16, 2007

http://www.getmetola.com/SocialGrabbr/login.php

and im trying the code now

the username is test

and the password is test

teng84 · December 16, 2007

i see. hmm i guess you query found zero result try to remove the where clause to check if the codes i gave you works.

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password))){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	//$sql=mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password`= '".$password."'") OR die(mysql_error());
	$sql=mysql_query("SELECT * FROM `users`") OR die(mysql_error());

	print_r(mysql_fetch_assoc($sql));
	echo 'look here';
	$c=mysql_num_rows($sql);
	if($c>0){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		header("Refresh: 2; url=home.php"); // what is this thing for? 
	//	header("location: home.php"); // what is this thing for? 
	}else{
		echo "<center>You couldn't be logged in!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

try

Northern Flame · December 16, 2007

try this:

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password))){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	$sql = mysql_query("SELECT * FROM `users` WHERE `username` = '$username' && `password`= '$password'") OR die(mysql_error());
	print_r(mysql_fetch_assoc($sql));
	echo 'look here';
	$c = mysql_num_rows($sql);
	if($c == 1){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		//header("Refresh: 2; url=home.php"); // what is this thing for? 
		header("location: home.php"); // what is this thing for? 
	}else{
		echo "<center>You couldn't be logged in!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

teng84 · December 16, 2007

Northern Flame what are the changes you made ?

Northern Flame · December 16, 2007

I just told it label you logged in if the mysql_num_rows returns

1 instead of a number greater than 0

I know its pretty much the same thing, but I couldnt really

find anything wrong with the script so I thought I might

as well give it a try

Northern Flame · December 16, 2007

alright,

here try this so we can see what is the field that is giving us trouble

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password))){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	$sql = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'")or die(mysql_error());
	print_r(mysql_fetch_assoc($sql));
	echo 'look here';
	$c = mysql_num_rows($sql);
	if($c == 1){
		echo "username $username found!";
		$p_sql = mysql_query("SELECT * FROM `users` WHERE `username`='$username' && `password`='$password'")or die(mysql_error());
		$p_check = mysql_num_rows($p_sql);
		if($p_check == 1){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		//header("Refresh: 2; url=home.php"); // what is this thing for? 
		header("location: home.php"); // what is this thing for? 
		} else{
		echo 'Incorrect password!';
		}
	}else{
		echo "<center>Invalid Username!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

This will let us know if the username or password is invalid

quickstopman · December 16, 2007

teng the code you gave me works but the problem is that its not secure

well atleast i don't think enough, because i plan for this site to have alot of traffic

teng84 · December 16, 2007

which one? tell me and ill try to modify it a little better

quickstopman · December 16, 2007

ok

well Northern Flame i used your code

and i edited it a little bit

here it is:

<?php
session_start();
include'header.php';
include'config.php';
?>
<div style="background:url(inner_top.png); width:650px; height:45px;">
</div>
<div style="background:#ffffff; width:630px; color:#222222; font-size:14px; padding-top:10px; padding:10px; padding-bottom:0px;">
<font color="red">
<?php
$username = mysql_real_escape_string(strip_tags(htmlspecialchars($_POST['username'])));
$password = md5($_POST['password']);
if (isset($_POST['login'])){
if (!isset($username) || !isset($password)){
	echo'<center>Please enter both - username and password!</center>';        
}else{
	$sql = mysql_query("SELECT * FROM `users` WHERE `username` = '$username'")or die(mysql_error());
	$c = mysql_num_rows($sql);
	if($c == 1){
		$p_sql = mysql_query("SELECT * FROM `users` WHERE `username`= '$username' AND `password`='$password'")or die(mysql_error());
		$p_check = mysql_num_rows($p_sql);
		if($p_check == 1){
		$r=mysql_fetch_array($sql);
		$_SESSION['id'] = $r['id'];
		$_SESSION['username'] = $r['username'];
		//header("Refresh: 2; url=home.php"); // what is this thing for? 
		header("location: home.php"); // what is this thing for? 
		} else{
		echo 'Incorrect password!';
		}
	}else{
		echo "<center>Invalid Username!</center>";
	}

}
}
?>
</font>
<form action="login.php" method='POST'>
Username: <input type='text' name='username' value="<? echo $_POST['username'] ?>"><br>
Password: <input type='password' name='password'><br>
<input name="login" type="submit" value="Submit"><br>
Not <a href="register.php">registered</a>?
</form>
</div>
<div style="background:url(inner_bottom.png); margin-top:-14px; width:650px; height:45px;">
</div>
<?php
include'footer.php';
?>

there is still one problem it always says i have the wrong password

teng84 · December 16, 2007

maybe your not really getting results form your db using that username and password like i told you print out the results of your query to check. maybe your getting 00 results that is why you always get that massage.. you have to determine if your query searches something

quickstopman · December 17, 2007

it gets all the info but it doesn't seem to like to compare md5

weird

Northern Flame · December 17, 2007

are you sure your password in your database is encrypted via md5()

quickstopman · December 17, 2007

yup

Sign In

[SOLVED] login not working for unknown reason

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information