Question

I am constructing a simple login php page.
The problem is, whatever I put as username or password, I get back this syntax error:

“You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘ AND user.password = ”’ at line 4″

I don’t seem to understand what’s wrong, even though I searched in google for similar problems. I use MAMP (if that helps).
Can someone please help me?

My check.php file goes like this:

<?php 
session_start();

$hostname = "localhost"; 
$database = "mydb"; 
$username = "myuser"; 
$password = "mypsw";

$link = mysql_connect( $hostname , $username , $password ) or 
        die("Attention! Connection problem with server : " . mysql_error());

mysql_select_db($database,$link);

$Qcheck_user = "SELECT user.* 
                FROM `user`
                WHERE user.username = '$user'
               AND user.password = '$psw' "; 

$check_user = mysql_query($Qcheck_user , $link) or
                die("Attention!Problem in selection of table user : " . mysql_error()); 

$number = mysql_num_rows( $check_user );

if ( $number == 0) 
{
    echo "Connection problem. Please try again. <br>";

    echo "<a href=\"login.php\">Πίσω</a>";

    exit;
}
else
{
    $user = mysql_fetch_array( $check_user);

    $Username = $user[0]; 
    $Name = $user["name"]; 
    $Surname = $user[3]; 
    $Email = $user["email"];


    session_register( "Username" , "Name" , "Surname" , "Email" ); 

    header("Location: home.php");
}

?>

Answer 1

Remove these akward  characters and just do this

$Qcheck_user = "SELECT user.* 
            FROM `user`
            WHERE user.username = '$user'
            AND user.password = '$psw' "; 

Difference:

               AND user.password = '$psw' "; 

and

                 AND user.password = '$psw' ";