Search mysql via php

[Jmacp]

Trying to make a login page...inputs are username and password.

So i need to search the db to see if the username exisits first then, if so, check the password is ok, thought i could do something like,

$link = mysql_query("select * from tlogin where username = '".$username."'");

if(!$link){

echo "wrong username";

}else{

} 

Can i do that or is there a better way ?

[john tindell]

You could just check to see if the username and password exist in your databse in one query. try something like this,

 $link = mysql_query("select username from tlogin where username = '".$username."' and password = '" . $password . "' LIMIT 1");
$result = mysql_fetch_row($link);
if(!empty($result)){

echo "You are logged in: " . $result['username'];

}else{
echo "Wrong username and or password";
} 

I havent tested this but im pretty sure it will work

[Jmacp]

Ok so you click the login button for

yoursite/login.php

which takes you to yoursite/login_auth.php

and runs through this code.

Is it fair to say,

$link = mysql_query("select username from tlogin where username = '".$username."' and password = '" . $password . "' LIMIT 1"); 
$result = mysql_fetch_row($link); 
if(!empty($result)){ 

Header("Location: http://yoursite/main.php"); 
}else{ 

Header("Location: http://yoursite/login.php"); 

* need to add text in /login.php saying that login was invalid

} 

If so, how do i append text to the original login.php saying, login invalid ?
Must be some fancy tricks for doing this..

[BoneCrif]

just put

$link = mysql_query("select username from tlogin where username = '".$username."' and password = '" . $password . "' LIMIT 1"); 
$result = mysql_fetch_row($link); 
if(!empty($result)){ 

Header("Location: http://yoursite/main.php"); 
}else{ 
echo "Incorrect username or password";
echo "<br/><a href=\"http://yoursite/login.php\">Go Back</a>";
} 

or where ever they're supposed to login to

[Jmacp]

just put

$link = mysql_query("select username from tlogin where username = '".$username."' and password = '" . $password . "' LIMIT 1"); 
$result = mysql_fetch_row($link); 
if(!empty($result)){ 

Header("Location: http://yoursite/main.php"); 
}else{ 
echo "Incorrect username or password";
echo "<br/><a href=\"http://yoursite/login.php\">Go Back</a>";
} 

or where ever they're supposed to login to

Yeah that works but looks a bit better for what i was asking, any ideas how to go about this ?

[BoneCrif]

I think this is what you are asking...
on login.php put

if ($mode = isset($HTTP_GET_VARS) ? htmlspecialchars($HTTP_GET_VARS) : '' == "invalid")
{
    echo "Login Invalid";
}
//the rest of the form below... 

on your login_auth.php page:

$link = mysql_query("select username from tlogin where username = '".$username."' and password = '" . $password . "' LIMIT 1"); 
$result = mysql_fetch_row($link); 
if(!empty($result)){ 

Header("Location: http://yoursite/main.php"); 
}else{ 
Header("Location: http://yoursite/login.php?mode=invalid"); 

} 

[Jmacp]

Perfect thanks!

[Jmacp]

moving on.

after a person logs in, they're taken to a page yoursite.com/user.xml

how do i stop them directly accessing that page unless they hae logged in first?

[BoneCrif]

you should use sessions, and cookies (pretty much same thing)
which I'm not going to begin to tell you about
just searh "php sessions tutorial" on google
or use http://php.net

[john tindell]

you should use sessions, and cookies (pretty much same thing)
which I'm not going to begin to tell you about
just searh "php sessions tutorial" on google
or use http://php.net

Also search this forum as lots of people have asked questions about sessions and user management.

[Jmacp]

came up with this, pretty basic but works,

<?php

function  CheckMysql($msg) {

if (!$msg) {

   die('Could not connect: ' . mysql_error());
           }
}

$username = $_POST['username'];
$password = $_POST['password'];

$conn =mysql_connect ("localhost","root","");

  CheckMysql($conn);

$link=mysql_select_db("tracker",$conn);

  CheckMysql($link);

$link = mysql_query("select username from tlogin where username = '".$username."' LIMIT 1"); 

  CheckMysql($link);

$result = mysql_fetch_row($link); 

if(!empty($result)){ 
 
   $link = mysql_query("select password from tlogin where password = '".$password."' LIMIT 1"); 
 
   $result = mysql_fetch_row($link); 

if(empty($result)){

  Header("Location: login.php?mode=invalidpass"); 

}else{

  Header("Location: stuff.php"); 

     }

}else{

   Header("Location: login.php?mode=invaliduser");

}

mysql_close();

?>