Question

I’m attempting to create a very simple CMS with PHP and MYSQL. The problem I’m having is that whenever I attempt to log in, if I put in the wrong username, what I want to happen happens. It goes to a screen that says wrong input and has a link going back to the login page. However if I put in the correct username and the wrong password it just reloads the page and if I put in the correct password, the same screen comes up as if I put in the wrong username, telling me the user name or password is wrong. I’ve checked the database to make sure the password I’m entering is correct and the username and password are both correct yet it’s not working. Can anyone help me out with this? Thank you in advance

Here are the functions that you may need to see:

function verifyUser($name, $pass)
{
// Escape strings
$username = mysql_real_escape_string($name);
$password - mysql_real_escape_string($pass);

$result = mysql_query("select * from users where username='$username' and       password-'$password' limit 1");

if (mysql_fetch_array($result))
{
    return true;
} else{
    return false;
}

}

function validateUser($name, $pass)
{
    $check = verifyUser($name, md5($pass));

    if($check)
    {
        $_SESSION['status'] = 'authorized';

        header('Location: http://localhost/cms/admin/index.php');

    } else{

        echo'Please enter a correct username and password <br />';
        echo "<a href='http://localhost/cms/admin/login.php'>Try Again?</a>";
        exit;
    }



}

Here is the login.php file:

require_once '../functions.php';

connect();

if($_POST['username'] && $_POST['password'])
{
$result = validateUser($_POST['username'], $_POST['password']);
}


?>

<form method="post" action="">
<p>
    <label for="name">Username: </label>
    <input type="text" name="username" />
</p>

<p>
    <label for="password">Password: </label>
    <input type="password" name="password" />
</p>

<p>
    <input type="submit" id="submit" value="Login" name="submit" />
</p>
</form>

I am receiving one Notice: Undefined index: username in C:\xampp\htdocs\cms\admin\login.php on line 14

Answer 1

Try adding die(); after your header('Location: ...'); line in successful login attempt.

To correct the undefined index error, change this in login.php:

if( isset($_POST['username']) && isset($_POST['password']) )

Additionally, you have an error in your query. The minus sign should be an equal sign (you had password-'$password'. Unless you need to capture user data, you should try counting the results, instead of fetching them.

$result = mysql_query("select * from users where username='$username' and       password='$password' limit 1");

if ( mysql_num_rows( $result ) > 0 )