POSTmethod and PHP- login verification

Question

I wrote a code for login verification..I got output with GET. But i need output with POST since it is more secure.pls let me know if there is any error in my code.

javascript code:

var xml;
function verifyusernamepasswd(pass)
{
//pass is password that will be passed as parameter
xml=new XMLHttpRequest();
var url="http://localhost/loginvalidate.php";
var para="q="+username+"&p="+pass;//username is global
xml.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xml.setRequestHeader("Content-length", para.length);
xml.setRequestHeader("Connection", "close");
xml.open("POST",url,true);
xml.onreadystatechange=statechanged1;
xml.send(para);

}

function statechanged1()
{
if(xml.readyState==4)
alert(xml.responseText);

}


php code:

<?php
$username=$_POST["q"];
$password=$_POST["p"];
$con=mysql_connect("localhost","root","blaze");
if(!$con)
{
die('Could not connect: '.mysql.error());
}
mysql_select_db("BLAZE",$con) or die("No such Db");
$result=mysql_query("SELECT Passwword FROM USERTABLE WHERE Userhandle='$username'");
if($result==null)
echo "false";

else if($result!=null)
{
$row=mysql_fetch_array($result);
if((strcmp($row['Passwword'],$password)==0))
echo "true";
else
echo "false";
}

?>

the verification does not return anything, cos my alert is not displayed at all...pls tell me whats wrong....

Answer 1

Have you tried accessing the PHP page directly to see if there are any errors? You might also want to try using Firebug (for Firefox), or the developer tools in Chrome to make sure that the request is actually being sent, and inspect the result.

Is Passwword spelt that way in the database, or is it just a typo in your PHP?

Finally, while it won't cause you problems now, it might down the line: your code is vulnerable to SQL injection - a malicious user could pass some bad arguments and do nasty things to your database. You need to escape $username before using it in a SQL query, e.g.:

"SELECT ... WHERE userhandle = '" . mysql_real_escape_string($username) . "'"