Question

I developed code in PHP but it’s not working. Sometimes the code works but most of the time not. The problem is in showing whether the password is valid or not.sorry friends i forgot to changed that but my problem with it only show invalid even i entered valid user name and password..plz help me

if(isset($_POST['submit']))
{
$con = mysql_connect("localhost","root","");
$db = mysql_select_db("billmailid", $con);
        if (!$con)
            {
        die('Could not connect: ' . mysql_error());
            }
$username=$_POST['usernameid'];
$password=$_POST['passwordid'];

$result = mysql_query("SELECT * FROM login");


$check = mysql_query("SELECT username FROM login WHERE username = '$username' && password= '$password'") ;

$check2 = mysql_num_rows($check);

if($check2==1)
  {
   echo "valid";
  }
else
  {
  echo "invalid";
  }
}
?>

Answer 1

Well, first off all it would be great if you rephrase the question title and body, add examples, errors and in general – make it readable.

Second in SQL || is OR and && is AND. You should probably start from there.

Third – you should really read about SQL Injection. And I don’t mean the XKCD comics.
In the following link you can find few examples and guidelines about how the make clear and safe query for both your database and your users

Forth – You better not use user empty root password and defiantly not use the “root” as the website user.

Writing save code is sometimes pain, but the sooner you start the more natural it comes. furthermore “making” application secure is much harder than building it safe.