Question

I am just trying to write a simple script that verifies the username and password of a user that has attempted to login…and then starts a session. However, I am running into some trouble.

When I try to run the script below, SUCCESS does not print out. As if the username and password is incorrect, however, I know for a fact that the username and passwords entered are, in fact, correct.

$username = $_POST['username'];
$password = $_POST['password'];

$result = mysql_query("SELECT * FROM users WHERE username='.$username.' AND password='.$password.'");

while($row = mysql_fetch_array($result)){
    echo 'SUCCESS';
}

When I try to run the script below however, success prints out twice (which is the number of sample users I have in my db so far), which is correct.

I am guess I have a problem with the AND mySQL query above, however, it seems correct to me… is there a problem with my first query above? if not, than what else might be the problem?

$username = $_POST['username'];
$password = $_POST['password'];

$result = mysql_query("SELECT * FROM users");

while($row = mysql_fetch_array($result)){
    echo 'SUCCESS';
}

Answer 1

You’re parsing variables, not concatenating them, you don’t need the ..

"SELECT * FROM users WHERE username='$username' AND password='$password'"