Basic Login Script using php and mysql inquiry

Question

Attempting to write a check for a login script to see if the username is available.

Would the best way to write this query be to check

if isset(!_POST[]) for both values (nick and pass)

then connect to database

WHERE the mysql database for the usernick requested

return the user id if the usernick exists

evaluate if isset($id) to see if the user name is taken

and use that to continue to creating an entry

Does this logically sound like a method to check for login without using excessive code

sorry for not posting the code, it is on another computer and this computer is locked down by my administrator at work...

Also, is there another way to evaluate if a value exists in the database?

For instance, instead of setting $id to the return value of the mysql database can i just ping the mysql database for the information and have it return a Boolean result so I am not putting out any user information.

Thanks, Matt

Answer 1

You can just SELECT username WHERE username LIKE $username (don't forget to sanitize and filter $username before to use it in a query).

Then use $result = mysql_fetch_array($query); and count($result);

If count($result) is equal to 0 or null, then, there is no such username in database.

Answer 2

You can do :

SELECT NULL FROM <Table> WHERE <Conditions>

When you run your query, if you get a row/rows, then your condition is met, if you get 0 rows, then they don't (therefore whatever you are looking for does not exist).

As Boris mentioned, do not forget to sanitize your inputs.!

What this query is supposed to do, is return rows with a NULL value, if what you were looking for in your criteria is met. That is, for example you do :

SELECT NULL FROM Users WHERE Name = 'something';

And you get :

| NULL |
1 row(s) returned.

It means that a user with that name exists, in the other hand you would get:

0 rows returned.

That means it does not exist.

In PHP you could easily use mysql_num_rows($result) to test for this, if you get 0 rows then your user does not exist.

This is of course only useful if you are JUST testing the existance of something, if you actually need the information, you need to do a normal query.

Answer 3

Try this.

$username = $_POST['username'];
$password = $_POST['password'];

$result = mysql_query("SELECT * from <table name> WHERE username = $username AND password = $password", $connection);

$row = mysql_fetch_array($result);

if(mysql_num_rows($row) == 1) //assuming username, password pair is unique
echo "Login Successful";
else
echo "Login Unsuccessful";