Help MySQL problem

PHP problem

[Ben878]

Hi I was wondering how do I use variables in a MySQL query?

mysql_query("SELECT memberName , passwd FROM smf_members WHERE memberName=$realuser AND passwd=$realpass");
if (!$result) {
echo "7";
}
if ($result) {
echo "1";
}

There is my attempt and it doesn't quite work. Im just learning PHP by the way. So really I'm just wondering how to use variables in a MySQL query. The variables $realuser and $realpass are strings by the way.

[bkeep]

try this

$result = mysql_query("SELECT memberName, passwd FROM smf_members WHERE memberName='" . $realuser ."' AND passwd='" . $realpass . "'");
if (!$result) {
echo "7";
}
if ($result) {
echo "1";
} 

[eelixduppy]

Remember to escape your variables when you insert them into a query. It should look like the following:

$result = mysql_query("SELECT memberName, passwd FROM smf_members WHERE memberName='" . [url=http://www.php.net/mysql-real-escaep-string]mysql_real_escape_string[/url]($realuser)."' AND passwd='" . mysql_real_escape_string($realpass) . "'"); 

Make sure to take a look at that because it's very important to the security of your database.

[Ben878]

thanks I got it working in the end. Now I have run into another little problem. IS it possible to do something like this:
[code]
if ($something=$something and $somethingelse=$somethingelse)
{
//Execute code
}

[eelixduppy]

Not sure exactly if you wrote what you wanted to write. However, conditionals are very useful control structures and you should really get familiar with them if you want to do any php scripting. Read up them at php.net: [php.net...]

[bkeep]

this should work
PHP operators

== is equal to
and
&& and
¦¦ or
! not

if ($something==$something && $somethingelse==$somethingelse)
{
//Execute code
} 

Hope that helps
Best Regards,
brandon

[Ben878]

Hey thanks for all the help. Now I have it all working. But I am on my final problem:

while ($row = mysql_fetch_assoc($result))
{
if ($row['memberName']==$user & $row['passwd']==$hashed)
{
echo "1";
}
else
{
echo "7";
}
}
mysql_close($con);

This is the end of my code. It works and displays a "1" if you enter correct information, however it doesn't display a "7" if you enter incorrect information.

[eelixduppy]

This:

if ($row['memberName']==$user & $row['passwd']==$hashed) 

Should be written like the following:

if ($row['memberName']==$user [b]&&[/b] $row['passwd']==$hashed) 

Notice how I added the additional ampersand sign.

[Ben878]

Fixed but I still don't see a 7 if I enter incorrect details. Just a blank page.

[eelixduppy]

A blank page signifies an error somewhere along the line. Add the following line to the top of the script to see all the errors:

error_reporting(E_ALL);

Make sure to let us know what errors this is giving you.

[Ben878]

I added it and it gave me no errors... a blank page.

[Ben878]

Sorry for double post. Here is the code of the whole page:

<?php 
$con = mysql_connect("localhost","removed","removed");
if (!$con)
 {
echo "8";
 }
$hashed = sha1(strtolower($user) . $password);
mysql_select_db("dinsdale_forum", $con);
error_reporting(E_ALL);
$result = mysql_query("SELECT memberName , passwd FROM smf_members WHERE memberName='" . mysql_real_escape_string($user)."' AND passwd='" . mysql_real_escape_string($hashed)."'");
while ($row = mysql_fetch_assoc($result))
{
if ($row['memberName']==$user && $row['passwd']==$hashed)
{
echo "1";
}
else
{
echo "7";
}
}
mysql_close($con);
?>

[eelixduppy]

Then you have something in your query that isn't selecting any results in which case it will not echo anything to the browser if it cannot find anything.

You might also want to consider checking for mysql errors:

$result = mysql_query("SELECT memberName , passwd FROM smf_members WHERE memberName='" . mysql_real_escape_string($user)."' AND passwd='" . mysql_real_escape_string($hashed)."'") or die(mysql_error()); 

[Ben878]

Ah I see... So how can I make it echo a "7" if the query returns no results?

Did the error checking and nothing was wrong.

[eelixduppy]

if(!$result) {
echo 7;
}

[phranque]

welcome to WebmasterWorld [webmasterworld.com], Ben878!