Forum Moderators: coopster
<?php
$dbh=mysql_connect ("localhost", "example", "example") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("example");
session_start();
$username=$_POST['username'];
$password=md5($_POST['password']);
$sql="select * from Users where username='$username' and password='$password'";
$result=mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($result)!=1){
$error="Login Failed";
include "login.php";
}else{
$row=mysql_fetch_array($result);
$_SESSION['username']="$username";
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
header("Location:http://members.example.com/{$row['USLP']}");
}
?>
$result = mysql_query("INSERT INTO users (username) VALUES('joe')"); but don't put it after the SELECT while, loop. Put it just before.
[edit] Actually, I'd put it right after the select_db line.
<?php
$dbh=mysql_connect ("localhost", "username", "password") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("database");
session_start();
echo "\$dbh = $dbh<br>\n";
$username=$_POST['username'];
$password=md5($_POST['password']);
$sql = "select * from users";
$result = mysql_query($sql);
while ($query_data = mysql_fetch_array($result)) {
echo "username = '".$query_data['username']."'<br>\n"; }
$result=mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($result)!=1){
$error="Not a Valid Username or Password";
echo "\mysql_num_rows ($result) = mysql_num_rows ($result)<br>\n";
}else{
$row=mysql_fetch_array($result);
$_SESSION['username']="$username";
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
header("Location:http://members.example.com/{$row['USLP']}");
}
?>
if (!mysql_query("INSERT INTO users (username) VALUES('joe')")) die("INSERT error: ". mysql_error());As for adding data to the table from a script, just use a form similar to your login form, but with a target script that receives the data, and...
if (!mysql_query("INSERT INTO users (username, password, UDLP) VALUES('$username', '$password', '$UDLP')")) die("INSERT error: ". mysql_error());If you have a bunch of data that you want to import, there are many shortcuts to doing this. But the above would be, essentially, what you'd need for a registration form.
Also, I'm curious to know what that 'box' is about. View the source of the HTML output, and post back here what it says. That's going to be of key importance to figure out what PHP MyAdmin is inserting.
Warning: Cannot modify header information - headers already sent by (output started at Line 20.
No. That's not what it was. Had it been just blank, it wouldn't have printed anything.
And, you can look at the source even though you're running a separate script. The echos were printing to the browser, right? So, when you echo something out like that, and see in with your browser, it IS in the source.
This is what I see when I hit View Source. This is showing the page source of login.php which is the script we have been working on. O.k. I think maybe on the box instead of having a type like VARCHAR or CHAR I didn't select anything and that is why nothing displayed. When I exported the records the only fields filled in were the password fields. I re-entered the records carefully and I was able to see it. So I believe the box displayed due to an error on my part. Do you know why this doesn't compare the username and password entered to that in the database?
If I take - WHERE username='$username' and password='$password' - out I receive this message.
$dbh = Resource id #2
username = 'guest'
Warning: Cannot modify header information - headers already sent by (output started at /home/joe1182/public_html/members/login.php:5) in /home/joe1182/public_html/members/login.php on line 20
Why does this happen? What can I do to check the username and password against that of the database and if it matches then redirect to the specified URL and if it doesn't match then the user would receive an error message. Any help?
That's almost certainly a character encoding issue, as in the character is a UTF-8 or Windows-1252 and you are using ISO-8859-1 or some such thing.
Warning: Cannot modify header information
The moment you output anything, close the header and cannot send anything more. So once you echo in line 5, you can't then send the header("Location....") in the last line.
Tom
...then we know the password is not being encrypted when it is being entered into the database. If the password looks something like what you showed us in message #11, then it is being encrypted during the INSERT operation, as it probably should be -- it's not a good idea to store passwords in plain text value.
+----------+----------+------+
¦ username ¦ password ¦ UDLP ¦
+----------+----------+------+
¦ guest ¦ guestpwd ¦ UDLP ¦
¦ other ¦ otherpwd ¦ UDLP ¦
+----------+----------+------+
If it is being encrypted when you store it (INSERT/UPDATE operations), then we need to encrypt it before we compare it, which you have shown us you are doing by using the PHP md5() function. Also, you need to take a look at how the password is being encrypted during the INSERT/UPDATE operations.
I don't know what UDLP is, and for the sake of this discussion it doesn't matter, at least not yet anyway.
When you compare passwords, are you encrypting the user entered password too?
In other words
if ($DB_data['password'] == md5($_POST['password')) {do stuff}
not
if ($DB_data['password'] == $_POST['password') {do stuff}
I seem to remember that you are doing it as in the first example, which is correct...
<?php
$dbh=mysql_connect ("localhost", "username", "passsword") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("database");
session_start();
$username=$_POST['username'];
$password=md5($_POST['password']);
$sql = "select * from users";
$result = mysql_query($sql);
while ($query_data = mysql_fetch_array($result)){
echo "username = '".$query_data['username']."'<br>\n"; }
$result=mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($result)!=1){
$error="Not a Valid Username or Password";
}else{
$row=mysql_fetch_array($result);
echo "\mysql_num_rows ($result) = mysql_num_rows ($result)<br>\n";
$_SESSION['username']="$username";
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
header("Location:http://members.example.com/{$row['USLP']}");
}
?>
<?php
$dbh=mysql_connect ("localhost", "username", "password") or die ('I cannot connect to the database because: ' . mysql_error());
mysql_select_db ("database");
session_start();
$username=$_POST['username'];
$password=md5($_POST['password']);
$sql = "select * from users where username='$username'";
$result = mysql_query($sql);
$result=mysql_query($sql) or die(mysql_error());
if(mysql_num_rows($result)!=1){
$error="Not a Valid Username or Password";
print $error;
}else{
$row=mysql_fetch_array($result);
$_SESSION['username']="$username";
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
header("Location:http://members.example.com/{$row['USLP']}");
}
?>
This is very important. Are you using the md5() function on the way in as well (during the INSERT/UPDATE operations)?
Since your code is working as is, although we aren't checking the password yet, let's add our own "debug" block of code here, much like we were doing earlier, but this time I'll put it in between comment blocks so as to eliminate confusion. Add the following comment block to your code. I'll include a few lines of your existing code before and after so you can see where you should add it:
if(mysql_num_rows($result)!=1){
$error="Not a Valid Username or Password";
print $error;
}else{
$row=mysql_fetch_array($result);
// Start debug/comment block
// We want to compare the password values:
print '<pre>'; // makes it easier to read and compare
print "The post password value: $password<br />";
print "Database password value: " . $row['password'];
exit('<pre>'); // exit stops the script here
// End debug/comment block
$_SESSION['username']="$username";
$_SESSION['ip']=$_SERVER['REMOTE_ADDR'];
header("Location:http://members.example.com/{$row['USLP']}");
}
This is the response I get. Any idea what this means?
hehe. OK, serious now. Your password column in your database is probably not large enough to hold the md5 encrypted value and it is being truncated. You will probably want to set the password column value to 32 characters.
[php.net...]
[dev.mysql.com...]
[zend.com...]
Good job coopster and joe. That was quite a process!
