Question

<?php

include ("account.php") ;

( $dbh = mysql_connect ( $hostname, $username, $password ) )
        or    die ( "Unable to connect to MySQL database" );
print "Connected to MySQL<br>";

mysql_select_db($project);

$number =   NULL ;
$username   =   $_POST["username"];
$priority   =   $_POST["priority"];
$category = $_POST["category"];
$incident_description = $_POST["incident_description"];


$sql  =   "insert into incident values ( NULL,       '$username','$priority','$category','$incident_description',curdate(),curtime() )" ;

mysql_query ( $sql )    or   print ( mysql_error ( ) );

$credentials = "select * from Credentials where ("username" = '$username' ,"password" =  '$password' , "email_address" = 'email_address')" ;

print $credentials;

$result = mysql_query ($credentials) or print (mysql_error ( ) );

$howManyRows = mysql_num_rows ( $result);

//if $howManyRows is positive continue process to update database with sql,if not,die.
?>

There is an html code for a form on another file hence the $_POST, but I don’t think it s necessary to show it here since I need the right syntaxes on this php file.

With the part from the $credentials I need help with how to compare the values in the html form (username,password,email_address) with values in the table "Credentials" from the database?I need to do this in order to authorize the values to carry on the process.
The syntax I got there isn’t right at the moment because it doesn’t execute it properly. I just don’t know how to compare the two.
This whole thing works up until the mysql_query ( $sql ) or print ( mysql_error ( ) ) line.

Suggestions would be nice.I apologize for the long question!

PS: columns for the Credentials table are username,password,email_address as well!

Answer 1

the problem is here

$credentials = "select * from Credentials where ("username" = '$username' ,"password" =  '$password' , "email_address" = 'email_address')" ;

change to

$credentials = "select * from Credentials where `username` = '$username' and `password` =  '$password' and  `email_address` = 'email_address'" ;

The problem is in query, when you want to check multiple values use AND in WHERE clause.