Question

This is for a login system. When I want the user to login I want it to take the given password and compare it to the column “Password” of the row that is given…In this case $usernameinput but the method I am using is not working. Any suggestions?

<?php

$usernameinput = $_POST["uname"];
$passwordinput = $_POST["pass"];

if (empty($usernameinput))
{
echo "";
}

else
{

$con = mysql_connect("localhost","STUFFFFF","STUFFFFFF");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

HERE IS WHERE IT SELECTS

mysql_select_db("STUFFFFF", $con);

$login = mysql_query("SELECT * FROM Users
WHERE Username='$usernameinput'");


while($row = mysql_fetch_array($result))
  {
    $matchpassword = $row['Password'];
  }
}

---

if (empty($passwordinput))
{
echo "";
}
else
{

if ("$passwordinput"=="$matchpassword")
{
$sqlusername = $usernameinput;
echo "You were logged in successfully, now you can visit the site as $sqlusername. <br />"; 
}
else
{
echo "You have entered an incorrect password.";
}

}
?>

<form action="login.php" method="post">
Username: <input type="text" name="uname" /> <br />
Password: <input type="password" name="pass" /> <br />
<input value="Login" type="submit" />
</form>

Answer 1

$sql = mysql_query('SELECT password FROM users WHERE username="'.mysql_real_escape_string($_POST['username']).'"';
$user = mysql_fetch_assoc($sql);
if ($user['password'] == sha1($_POST['password'])) {
    //Logged in
} else {
    //Wrong password
}

That way you prevent MySQL injections and the passwords of your users are safe.