User authentication

[Haraldo]

I have been having a bit of trouble trying to authorize my username and password against the MySql 'Users' table. For some reason even with a valid username and password in the database it always goes to the login failure page. I don't understand why the count does not work or why the record can't be recognised.

Here is the simpe authorization and login page:

<?php
if(!isset($HTTP_POST_VARS['name'])&&!isset($HTTP_POST_VARS['password']))
{
//Visitor needs to enter a name and password
?>
<h1>Please Log In</h1>
This page is secret.
<form method=&quot;post&quot; action=&quot;login2.php&quot;>
<table>
<tr>
<th> Username </th>
<td> <input type=&quot;text&quot; name=&quot;name&quot;> </td>
</tr>
<tr>
<th> Password </th>
<td> <input type=&quot;password&quot; name=&quot;password&quot;> </td>
</tr>
<tr>
<td colspan=&quot;2&quot; align=&quot;center&quot;>
<input type=&quot;submit&quot; value=&quot;Log In&quot;>
</td>
</tr>
</table>
</form>
<?php
}
else
{
// connect to mysql
$mysql = mysql_connect( 'localhost', 'username', 'password' );
if(!$mysql)
{
echo 'Cannot connect to database.';
exit;
}
// select the appropriate database
$mysql = mysql_select_db( 'dbName');
if(!$mysql)
{
echo 'Cannot select database.';
exit;
}

// query the database to see if there is a record which matches
$query = &quot;select * from Users where
username = '$name' and
password ='$password'&quot;;

$result = mysql_query( $query );
if(!$result)
{
echo 'Cannot run query.';
exit;
}

$count = mysql_num_rows($result);

if ( $count > 0 )
{
// visitor's name and password combination are correct
echo '<h1>Here it is!</h1>';
echo 'I bet you are glad you can see this secret page.';
}
else
{
// visitor's name and password combination are not correct
echo '<h1>Go Away!</h1>';
echo 'You are not authorized to view this resource.';
}
}
?>

If anyone could give me an idea where i might be going wrong whether it is to do with the code or whether my database might not be set up 100% correctly i would be very grateful.

Thanks H

 

[sleipnir214]

In general: faq434-2999

You got a good start with using $HTTP_POST_VARS, then you quit. I see references to variables $name and $password, but no statements assigning them values. Should they instead be references into $HTTP_POST_VARS, too?


Also, are you using a version of PHP of version 4.1.0 or newer? Use $_POST instead of $HTTP_POST_VARS. The reasons why are described here:

http://us4.php.net/manual/en/reserved.variables.php

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[Haraldo]

Thanks for replying so quickly. Reacting to what you said (sleipnir214) i have solved the problem i was having. Simply defined the variable $password and $username with the $HTTP_POST_VARS etc.

Thanks
H