Question

Okay, so I want to make a simple login page. I’ve created a register page successfully, but i can’t get the login thing down.

login.php:

<?php

session_start();

include("mainmenu.php");

$usrname = mysql_real_escape_string($_POST['usrname']);
$password = md5($_POST['password']);

$con = mysql_connect("localhost", "root", "g00dfor@boy");
 if(!$con){
  die(mysql_error());
}

mysql_select_db("users", $con) or die(mysql_error());

$login = "SELECT * FROM `users` WHERE (usrname = '$usrname' AND password = '$password')";
$result = mysql_query($login);

 if(mysql_num_rows($result) == 1 {

    $_SESSION = true;
    header('Location: indexlogin.php');
 }

   else {
echo = "Wrong username or password." ;
}


?>

indexlogin.php just echoes “Login successful.” What am I doing wrong?
Oh, and just FYI- my database is “users” and my table is “data”.

Answer 1

<?php

session_start();

include("mainmenu.php");

$usrname = mysql_real_escape_string($_POST['usrname']);
$password = md5($_POST['password']);

$con = mysql_connect("localhost", "root", "g00dfor@boy");
if (!$con) {
    die(mysql_error());
}

mysql_select_db("users", $con) or die(mysql_error());

$login = "SELECT * FROM `users` WHERE (usrname = '$usrname' AND password = '$password')";
$result = mysql_query($login);

if (mysql_num_rows($result) == 1) {
    $_SESSION['logged_in'] = true;
    header('Location: indexlogin.php');
    exit;
} else {
    echo "Wrong username or password.";
}

?>

• I added mysql_real_escape_string() to prevent SQL injection.
  No, I didn’t because you already had it.
• I cleaned up the formatting of the code a bit.
• I changed $_SESSION = true; (which doesn’t make sense) into $_SESSION['logged_in'] = true;. Then, in indexlogin.php you can do something like if ($_SESSION['logged_in']) { echo $secret; }
• I fixed echo = "Wrong username or password."; to echo "Wrong username or password.";
• I added a closing bracket near mysql_num_rows($result) == 1.

---

You said:

my database is “users” and my table is
“data”.

If this is correct, you will need to change SELECT * FROM users to SELECT * FROM data.