Question

I am trying to do to a user-pass validation. Updated code:

$username="------";
$password="------";
$database="------";
$host = "------";


mysql_connect($host,$username,$password);
mysql_select_db($database) or die( "Unable to select database");

$username = $_POST['username'];
$password = $_POST['password'];

echo 'username: ' . $username . '<br>';  //myname
echo 'password: ' . $password . '<br>';  //mypass

function checkpass()
{
    //$result = mysql_query("SELECT * FROM REG_USERS where USERNAME='$_POST[username]' and PASSWORD='$_POST[password]' ") or die(mysql_error());  
    $result = mysql_query("SELECT * FROM REG_USERS where USERNAME='" . $username . "' and PASSWORD='" . $password . "'") or die(mysql_error());  
    return  mysql_num_rows($result);
}

checkpass();
echo 'checkpass:'. checkpass();

In the first query checkpass returns 1. In the second one it returns 0. Why?

Answer 1

OK now we have the WHOLE code it’s obvious.

$username and $password aren’t global. The function doesn’t know what they are set to.

$username = $_POST['username'];
$password = $_POST['password'];

echo 'username: ' . $username . '<br>';  //myname
echo 'password: ' . $password . '<br>';  //mypass

function checkpass()
{
    $username = mysql_real_escape_string($_POST['username']);
    $password = mysql_real_escape_string($_POST['password']);

    //$result = mysql_query("SELECT * FROM REG_USERS where USERNAME='$_POST[username]' and PASSWORD='$_POST[password]' ") or die(mysql_error());  
    $result = mysql_query("SELECT * FROM REG_USERS where USERNAME='" . $username . "' and PASSWORD='" . $password . "'") or die(mysql_error());  
    return  mysql_num_rows($result);
}

NB I know about mysqli. OP isn’t asking about it, I’m not obsessing about it but I have added mysql_real_escape_string for good measure.