Question

For some reason my check login script is letting in guests.

I have not made the site live yet so its all good.

I check the database for the username and the password the user puts in the html form but for some reason if it don’t even get a result it still sets the username to nil
if it gets the result it sets the username to the username but if it don’t get any results it sets the username to nothing.

I have a if statement but still setting it.

$myusername = mysql_real_escape_string($_POST['myusername']);
$mypassword = mysql_real_escape_string($_POST['mypassword']);


$sql        = "SELECT * FROM users WHERE username='$myusername'";
$result     = mysql_query($sql) or die(mysql_error());
$battle_get = mysql_fetch_array($result);    

if ($battle_get['password'] == $mypassword)
{    
    $_SESSION['username'] = $myusername ; // store session data    
    header('Location: http://mydomainname.net/new_rpg/dashboard.php');      
} else {
    echo "wrong password" ;
}

Answer 1

Yur mistake:

Say I am not a user.

So $battle_get['password'] = false;

and $mypassword is also false,

so $battle_get['password'] equals $mypassword

Two way you can resolve this.

First, chek the password with sql:

$sql = "SELECT * FROM users WHERE username='$myusername' AND password = '$mypassword'";

or

if(!$battle_get) {

echo "wrong password" ;

}