Question

Need a bit of help with a form. I have created a form which require log in. Once a person has logged in they complete the form and then someone else checks the form and enters there password before the form is submitted.

I have set up some rules which checks the fields are completed correctly and I want to write some code that will check the password field is completed and then check it against the stored passwords in the database.

So far I have got this.

    if (!empty($_POST['password']))
{


/*connect to database to check password is valid*/
    $user_name = "contains username for database";
    $pass_word = "contains password";
    $database = "name of database";
    $server = "localhost";

    $db_handle = mysql_connect($server, $user_name, $pass_word);
    $db_found = mysql_select_db($database, $db_handle);

    if ($db_found) {

        $uname = quote_smart($uname, $db_handle);
        $pword = quote_smart($pword, $db_handle);

        $SQL = "SELECT * FROM masterpass WHERE password = $password";
        $result = mysql_query($SQL);
        $num_rows = mysql_num_rows($result);

        if ($result) {
            if ($num_rows > 0) {
                continue;
            }
            else {
                $error = true;



  }

Not sure if I am going about this the right way so any help would be great.

Thanks in advance
Matt

Answer 1

for starters, first you create $pword:

$pword = quote_smart($pword, $db_handle);

and in your query you use $password.

$SQL = "SELECT * FROM masterpass WHERE password = $password";

This can’t work.

Secondly, you should ask for username AND password in your query.

Last but not least: never save a password in clear text in your database. Generate a MD5 hash!