0

I am trying to make myself a simple PHP website with a member login system. I have created the registration part of the website and entries successfully update/add to my Mysql database. However I just cannot get my login.php to login using the details. My php code for login.php is as follows;

<?php
if ($_POST['mem_email']) {
//Connect to the database through our include 
include_once "storescripts/connect_to_mysql.php";
$email = stripslashes($_POST['mem_email']);
$email = strip_tags($email);
$email = mysql_real_escape_string($email);
$password = ereg_replace("[^A-Za-z0-9]", "", $_POST['mem_password']); // filter everything     but numbers and letters
$password = md5($password);
// Make query and then register all database data that -
// cannot be changed by member into SESSION variables.
// Data that you want member to be able to change -
// should never be set into a SESSION variable.
$sql = mysql_query("SELECT * FROM members WHERE mem_email='$email' AND         mem_password='$password' AND mem_emailactivated='1'"); 
$login_check = mysql_num_rows($sql);
if($login_check > 0){ 
while($row = mysql_fetch_array($sql)){ 
    // Get member ID into a session variable
    $id = $row["mem_id"];   
    session_register('mem_id'); 
    $_SESSION['mem_id'] = $id;
    // Get member username into a session variable
    $username = $row["mem_username"];   
    session_register('mem_username'); 
    $_SESSION['mem_username'] = $username;
    // Update last_log_date field for this member now
    mysql_query("UPDATE members SET mem_lastlogin=now() WHERE mem_id='$id'"); 
    // Print success message here if all went well then exit the script
    header("location: member_profile.php?id=".$id); 
    exit();
} // close while
} else {
// Print login failure message to the user and link them back to your login page
print '<br /><br /><font color="#FF0000">No match in our records, try again </font><br />
<br /><a href="login.php">Click here</a> to go back to the login page.';
exit();
}
}// close if post
?>

And form which is located on the same page is as follows;

<table align="center" cellpadding="5">
<form action="login.php" method="post" enctype="multipart/form-data" name="logform"  id="logform" onsubmit="return validate_form ( );">
<tr>
<td class="style7"><div align="right">Email Address:</div></td>
      <td><input name="mem_email" type="text" id="mem_email" size="30" maxlength="64" /></td>
    </tr>  
    <tr>
      <td class="style7"><div align="right">Password:</div></td>
      <td><input name="mem_password" type="password" id="mem_password" size="30" maxlength="24" /></td>
    </tr>
    <tr>
      <td>&nbsp;</td>
      <td><input name="Submit" type="submit" value="Login" /></td>
    </tr>
  </form>
</table>

My database looks like this

mem_id  int(11)
mem_username    varchar(255)
mem_country varchar(255)
mem_county  varchar(255)
mem_address varchar(255)
mem_email   varchar(255)
mem_password    varchar(255)
mem_signupdate  datetime
mem_lastlogin   datetime
mem_accounttype enum('a', 'b', 'c')
mem_emailactivated  enum('0', '1')
mem_postcode    varchar(255)
mem_city    varchar(255)

Every time the correct data is entered into my login form, I am processed to the else statement with the failure message

5
  • Have you echoed out the SQL statement you're generating and run it in the database? Does it work then?
    – andrewsi
    Feb 23, 2013 at 17:20
  • mysql_* and ereg_* are both deprecated. In fact I think ereg_* is missing entirely from the latest versions of PHP. As soon as your host upgrades their software your script will break.
    – GordonM
    Feb 23, 2013 at 17:20
  • This calls for basic debugging first. What exactly fails at which point? Finding that out - using a debugger or by doing test outputs line by line - would be the first thing to do. We cannot do this for you as we don't have the live output.
    – Pekka
    Feb 23, 2013 at 17:24
  • Side question, what is your reasoning behind disallowing non-alphanumeric characters in users' passwords?
    – Pekka
    Feb 23, 2013 at 17:25
  • And another, I'm noticing you're not error checking your queries using php.net/mysql_error . That's a prerequisite for doing proper debugging.
    – Pekka
    Feb 23, 2013 at 17:26

2 Answers 2

0

ereg_* and mysql_* functions are depreciated! Use preg_* functions and PDO or Mysqli for database interaction.

Also, use parameterized queries to prevent sql injections, which is supported by both PDO and mysqli.

When you want to return a count of records, you can let sql to do the counting for you. For example:

SELECT COUNT(*) FROM `members` WHERE `mem_emailactivated` = '1'

Now use the fetchColumn() method of PDO or use the alternative in mysqli to get the number of records that match the given conditions in our query!

Another thing is, for sessions to work correctly, use session_start() at the very beginning of every page.

Hope it helps. :)

0

Please use mysqli_ calls. mysql_ is deprecated http://www.php.net/mysql_fetch_row

This problem is more about proper debugging. This can be done by php echos, or even better a debugger, like in Eclipse PDT. Anyways, 1. check that if ($_POST['mem_email']) { is entered. 2. run the query in your database. It it's successfull: 3. Fetch a row using mysqli_fetch_row. I guess you need only one row. 4. if all these are ok, run the update query in your database to see if it's successfull.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.