Forum Moderators: coopster
<?php
$host = "localhost";
$username = "root";
$password = "";
$db_name = "ukkonkans";
$table_name = "users";
mysql_connect ("$host", "$username", "$password") or die ("Server Connection Failed"); //connecting to server
mysql_select_db("$db_name") or die ("Database Unavailable"); //selecting database
$loginname = $_POST['loginname']; //submitted through loginform.php
$pword = md5($_POST['pword']); // submitted through loginform.php
//Clearing the junk from contents of loginform.php
$loginname = stripslashes($loginname);
$pword = stripslashes($pword);
$loginname = mysql_real_escape_string($loginname);
$pword = mysql_real_escape_string($pword);
$sql = "SELECT * FROM $table_name WHERE userName = '$loginname' and password = '$pword'";
$result = mysql_query($sql);
//Check for number of rows
$count = mysql_num_rows($result);
//The above should give a result of 1 row
if ($count == 1) {
//Register the loginname and password and direct to other page
session_register("loginname");
session_register("pword");
header("Location: login_success.php");
} else {
echo "Wrong Username or password";
}
?>
<form name="login-form" id="login-form" method="post" action="<?php echo $PHP_SELF; ?>">
<fieldset>
<legend>Please Login:</legend>
<dl>
<dt>
<label title="Username">Username: <input type="text" name="loginname" maxlength="25" id="loginname"
value = "<?php echo $loginname; ?>" />
</label>
</dt>
</dl>
<dl>
<dt>
<label title="Password">Password: <input type="password" name="pword" maxlength="15" id="pword" />
</label>
</dt>
</dl>
<dl>
<dt>
<label title="Submit"><input type="submit" name="login" value="Login" />
</label>
</label></dt>
</dl>
</fieldset>
</form>
One way of doing this is to put a hidden input field in your form and then check to see whether this field exists. If the field exists you know that the form has been submitted. If the submitted username and password do not match what is stored in your database then you can output the error message to the browser.