Question

Ok so here is my issue, Some users cannot login to their accounts. They enter in their password and username properly but it just doesn’t seem to work.

and secondly I noticed that a few of the users can log into any account they want with their own password and not the password of the original account.

using MYSQL, and PHP5.

/*Login script*/

if (isset($_POST['Submit'])) {

    $loginUserName = ($_POST['loginUserName']);
    $loginUserName = stripslashes($loginUserName);
    $loginUserName = strip_tags($loginUserName);
    $loginPassWord = ($_POST['loginPassWord']);
    $loginPassWord = stripslashes($loginPassWord);
    $loginPassWord = strip_tags($loginPassWord);
    $loginPassWord = md5($loginPassWord);

    $loginSubmitQuery = "SELECT username,password FROM users WHERE username = '". mysql_real_escape_string($loginUserName ."' and password = '". mysql_real_escape_string($loginPassWord) ."'"; 
    $loginResultQuery = mysql_query($loginSubmitQuery) or die ("Could not find loginUserName and/or loginPassWord");
    $loginResultQuery2 = mysql_fetch_array($loginResultQuery);

     if ($loginResultQuery2) {
        $sql = "SELECT * FROM users WHERE username='".$loginUserName."'";   
        $result = mysql_query($sql)or die('_'.mysql_error());
        while ($row = mysql_fetch_assoc($result)) {
            $_SESSION['player']['id']               = $row['id'];
            $_SESSION['player']['username']         = $row['username'];
            $_SESSION['player']['gamestatus']       = $row['gamestatus'];
            $_SESSION['player']['healthpoints']     = $row['healthpoints'];
            $_SESSION['player']['maxhealthpoints']  = $row['maxhealthpoints'];
            $_SESSION['player']['manapoints']       = $row['manapoints'];
            $_SESSION['player']['maxmanapoints']    = $row['maxmanapoints'];
            $_SESSION['player']['level']            = $row['characterlevel'];
            $_SESSION['player']['strength']         = $row['strength'];
            $_SESSION['player']['defence']          = $row['defence'];
            $_SESSION['player']['monsterid']        = $row['monsterid'];
            $_SESSION['player']['decivers']         = $row['decivers'];
            $_SESSION['player']['experience']       = $row['experience'];
            $_SESSION['player']['nextlevel']        = $row['nextlevel'];
            $_SESSION['player']['inbattle']         = $row['inbattle'];
            $_SESSION['player']['monsterlevel']     = $row['monsterlevel'];
            $_SESSION['player']['monsterid']        = $row['monsterid'];

        }

        echo '<div id="loginaccess"><a href="home.php">[Success Click Here to Login]</a></div>';

    } else {

        echo '<div id="loginaccess">Invalid username or password.</div>';

    }
}
                ?>
            <form id="login" action="" method="POST">
                    <div id="uname" class="formfloat"><p><label for="loginUserName">Username:</label>
                    <input type="text" id="loginUserName" name="loginUserName" value="" class="formfield" tabindex="1" size="15" maxlength="20" /></div></p>
                    <div id="pword" class="formfloat"><p><label for="loginPassWord">Password: </label>
                    <input type="password" id="loginPassWord" name="loginPassWord" value="" class="formfield" tabindex="2" size="15" maxlength="20" /></div></p>
                    <div class="formbreak"></div><br />
                    <input id="loginsubmit" type="submit" value="Login" name="Submit" tabindex="3" >
            </form>
            </div>
        </div>
        <div id="sidebarRight"><!-- sidebarRight div start -->
        </div>

Answer 1

Your SQL query seems to be missing a clause when you’re validating the password. WHERE username = '$loginUserName' AND '$loginPassWord' will evaluate to true if the given username exists in the database, and the value of $loginPassWord evaluates to true (because you’re not comparing it to anything).

Furthermore, you should be escaping input you get from the user before using it in a database query, using something like mysql_real_escape_string, in order to prevent SQL Injection attacks.

Putting that together, I’d replace your query with something like:

$loginSubmitQuery = "SELECT username, password
  FROM users
  WHERE username = '" . mysql_real_escape_string($loginUserName) . "'
    AND password = '" . mysql_real_escape_string($loginPassWord) . "'";