php problem

Destroyer^ · 4 Jun 2011 at 19:40

Hey guys just having a problem with a login page at the moment, ive created a checklogin.php page and its saying theres a syntax error, if anyone could help

<?

$host = "localhost";

$username = "root";

$password = "***";

$db_name = "register";

$tbl_name = "members";

mysql_connect ($host, $username, $password) or die ("can't connect);

mysql_select_db ($db_name) or die (mysql_error)

$myusername = $_POST ['myusername'];

$mypassword = $_POST ['mypassword'];

$sql = "SELECT * FROM $tbl_name WHERE username ='$myusername' and password= '$mypassword'"
$result = mysql_query ($sql);

$count = mysql_num_rows ($result);

if ($count ==1) {
session_register ("myusername");
session_register ("mypassword");

header ("location:login_success.php");

}

else {

echo "wrong username or password";

}

?>

the orange is where the errors are popping up

Edward01 · 4 Jun 2011 at 19:44

missing ; on $sql line??

topdog@OC · 4 Jun 2011 at 19:44

No semi-colon at the end of the first orange line, so all your orange text looks like 1 line of code to PHP instead of 2.

topdog@OC · 4 Jun 2011 at 19:46

You could use one at the end of the mysql_select_db line too.

tntcoder · 4 Jun 2011 at 19:48

FYI, your code is also vulnerable to sql injection.

Destroyer^ · 4 Jun 2011 at 19:50

added both ;, still a syntax error on the same lines =/

tntcoder · 4 Jun 2011 at 19:53

mysql_connect ($host, $username, $password) or die ("can't connect);

missing " in that line

Randomface74 · 4 Jun 2011 at 19:55

$sql = "SELECT * FROM $tbl_name WHERE username ='$myusername' and password= '$mypassword'"

What if $myusername = $myusername + "'--"
??

Do you work for Sony?

Destroyer^ · 4 Jun 2011 at 19:57

lol, cheers is sorted now cheers tntcoder

topdog@OC · 4 Jun 2011 at 19:58

session_register() was deprecated in php 5.x and removed altogether in 6, have you checked your php version and also whether in a version that supports it, you have register_globals on?

For that section of code you might be better to follow the alternatives:

http://php.net/manual/en/function.session-register.php

Edit: Seems your parsing faults are all found/fixed now.

Xelene · 5 Jun 2011 at 00:48

hope you don't have any users on your site called "bob'; DELETE FROM members WHERE 1=1"

sharkkk · 5 Jun 2011 at 14:05

Little Bobby Tables, we call him

A.N.Other · 5 Jun 2011 at 16:10

And I hope you've learnt to sanitise your database inputs.

PS. Also #884

unwashed potato! · 5 Jun 2011 at 16:44

isn't it "WHERE username == '$myusername'"?

tntcoder · 5 Jun 2011 at 16:58

Mammalian said:
isn't it "WHERE username == '$myusername'"?

No, not with SQL.