ansaurus

Question

Answer 1

+1 A:

You have a lot of code there for what you're trying to achieve. Without trying to sound condescending, I'd suggest a return to the drawing board, google 'php user authentication' or similar and see if there are some simple examples you can follow.

BrynJ 2009-01-09 17:15:46

Answer 2

A:

<input type="password" name=" password" id="password" size="30">

You have a space in the password field's name, so the value is being stored in $_POST[' password'], not $_POST['password']

Sean Edwards 2009-01-09 17:17:17

Answer 3

A:

i removed the space it displays wrong username or password

2009-01-09 17:19:20

Answer 4

+12 A:

There's a few things you should change about that code...

You don't need to do !isset() and empty(): just empty() will do
You shouldn't be duplicating the HTML for the login page - either put it in a variable or include() it and use PHP to put the error message in there.
You're using deprecated HTML like <center> and <font> - replace them with CSS
In the javascript, submitOK="false"; should be return true;
name=" password" should be name="password" (whitespace in attributes should be trimmed but I wouldn't like to rely on it.
You're putting raw input into a mysql query, leaving yourself vulnerable to sql injection. Use mysql_escape_string()
Don't use session_register, use $_SESSION instead.
A header location should really be a canonical URL (starting http://) although every browser I know of accepts a relative URL.
Usability - take out the reset button.

Greg 2009-01-09 17:21:50

mysql_real_escape_string() might be better

Joe Philllips 2009-01-16 21:38:42

Answer 5

A:

You also might want to consider what would happen if I entered a password like this

' or 1=1 or '

Learn to sanitize all inputs which come from outside!

Paul Dixon 2009-01-09 17:27:57

Answer 6

+2 A:

Out of interest what does the generated HTML look like for that form?

as

action="<?php $_SERVER['PHP_SELF'];?>"

should be

action="<?php echo $_SERVER['PHP_SELF'];?>"

else you may find the generated html is action="" in which case it may not process the form as you expect

Re0sless 2009-01-09 17:33:45

Actually should be <?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>, like any time you output text to HTML, to stop injection exploits.

bobince 2009-01-16 22:02:01

Answer 7

A:

i dont know why it dosent recognize the user and password

2009-01-09 17:34:23

Answer 8

+1 A:

When ever you're having problems with a script, sometimes it's easier if you strip all of the extra fluff out. Try the code below. I've cleaned it up a little.

I haven't tested it, but I still think it's a step forward.

<?php

    session_start();

    /* If the form has been submitted. */
    if (!empty ($_POST))
    {

     /* If there is not missing data. */
     if (empty ($_POST['username']) && empty ($_POST['password']))
     {
      /* Connect to the database server. */
      $connection = mysql_connect ("localhost", "root") or die ("Error: can not connect to the database.");

      /* Select the database. */
      mysql_select_db ("login") or die ("Error: Can not select the database.");

      /* Make the query. */
      $login_check = mysql_query ("SELECT * FROM users WHERE username = '" . mysql_escape_string ($_POST['username']) . "' AND password = '" . mysql_escape_string ($_POST['password']) . "' LIMIT 1") or die ("MySQL query error.");

      /* If there is a row returned. */
      if (mysql_num_rows ($login_check) > 0)
      {
       echo 'The username and password have matched.';
       exit;
      }

      /* There were no rows returned. */
      else
      {
       $_SESSION['login_error'] = 'Incorrect username or password.';
      }
     }

     /* There's missing data. */
     else
     {
      $_SESSION['login_error'] = 'Both the username and password are required.';
     }
    }

?>  
<html>
    <head>
     <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
     <title>Testing Login Form</title>
    </head>
    <body>
     <form name="login" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
         <p>User name: <input type="text" name="username" id="username"></p>
         <p>Password: <input type="password" name="password" id="password"></p>
         <p><input type="submit" name="login" value="Login"></p>
         <?php

          if (!empty ($_SESSION['login_error']))
          {
           echo '<p>', htmlspecialchars ($_SESSION['login_error'], ENT_QUOTES), '</p>';
           unset ($_SESSION['login_error']);
          }

     ?>
     </form>
    </body>
</html>

Please take everything RoBorg typed into account. It's very good advice.

Ty 2009-01-09 17:53:45

ansaurus

tags:

views:

answers:

php login code problem

related questions