-1

I’m making a practice website for signing in, using PHP and MySQL. However, when I click submit, the PHP doesn't execute and get data from my database, but it is opened. I can’t seem to find what's wrong in my coding. I have checked and php is enabled and interpreted.

Here's my HTML file:

<!DOCTYPE HTML>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<title>Sign-In</title>
<link href="layout.css" rel="stylesheet" type="text/css"/>
</head>

<body>
<div id="sign-in">
<fieldset style="width:30%"><legend>Sign In Here</legend>
<form method="POST" action="connectivity.php">
Username<br><input type="text" name="username" size="40"><br><br>
Password<br><input type="password" name="password" size="40"><br>
<input id="button" type="submit" name="submit" value="Sign In">
</form>
</fieldset>
</div>
</body>
</html>

Here's my php file:

<?php
define('DB_HOST', 'localhost');
define('DB_NAME', 'databasename');
define('DB_USER', 'root');
define('DB_PASSWORD', 'password');
$con = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD) or die("Failed to connect to MySQL: " . mysql_error());
$db = mysql_select_db(DB_NAME, $con) or die("Failed to connect to MySQL: " . mysql_error());
/*
$ID = $_POST['username'];
$Password = $_POST['password'];
*/

function SignIn()
    {
    session_start();
    if (!empty($_POST['username']))
        {
        $query = mysql_query("SELECT* FROM Username WHERE username ='$_POST[username]' AND password ='$_POST[password]'", $db) or die(mysql_error());
        $row = mysql_fetch_array($query) or die(mysql_error());
        if (!empty($row['username']) AND !empty($row['password']))
            {
            $_SESSION['username'] = $row['password'];
            echo "Successfully Signed In.";
            }
          else
            {
            echo "Sorry, you entered the wrong username and password. Please Try Again.";
            }
        }
    }

if (isset($_POST['submit']))
    {
    SignIn();
    }

mysql_close($con);
?>

I'm using the tutorial from this website, but have different names. I'm pretty new at this, so when answering please be as specific as possible.

9
  • 2
    Your code is vulnerable to SQL injections. You should read on how to prevent them in PHP.
    – Gumbo
    May 11, 2014 at 7:02
  • 2
    Besides that, you may want to adjust the error reporting to see all errors.
    – Gumbo
    May 11, 2014 at 7:04
  • 1
    What exactly is going wrong?
    – Cully
    May 11, 2014 at 7:05
  • try adding error reporting to your php file: ini_set('display_errors',1); error_reporting(E_ALL);
    – Jentel
    May 11, 2014 at 7:06
  • 1
    Is this the exact code you're using? because you have a small error in your query. SELECT* should be SELECT *
    – Gil
    May 11, 2014 at 7:08

3 Answers 3

0

In your mysql_query try

$query = mysql_query("SELECT* FROM Username WHERE username =" . $_POST['username'] . "AND password ="._POST['password'],$db) or die(mysql_error($con));

You should use the . operator to concatenate strings. And you forgot the quotes in $_POST[].

0

I guess the reason is the missing quotes.

This:

$query= mysql_query ("SELECT* FROM Username WHERE username ='$_POST[username]' AND password ='$_POST[password]'",$db) or die (mysql_error());

Should probably be this:

$query = mysql_query("SELECT * FROM Username WHERE username = '{$_POST['username']}' AND password = '{$_POST['password']}'",$db) or die (mysql_error());

And a couple of other things

2
  • thanks, when I used mysqli, it said "failed to connect to mysql'. so does that mean something is wrong with my connection code? if so, what? May 11, 2014 at 7:54
  • mysqli_ is not the same as mysql_, so you'll have to change all of your database related code to use mysqli instead. But you can still use mysql. Just keep in mind that mysql_ is outdated and should not be used in new projects. Feel free to stick with mysql_ for learning, it's probably a bit easier since most of the older books and tutorials still uses it. Feel free to mark my answer as the solution if it was the solution.
    – Alex
    May 11, 2014 at 8:16
0

If you want to use both strings and varibles like "My name is $name", there are some ways o do it.

  1. Collecting strings with variables containing numbers and strings:

    • $var = 'My name is' . $name;
    • $var = "My name is" . $name;
    • $var = "My name is $name";
    • Note:
      $var = 'My name is $name;' won't output the $name value, but its name.
  2. Collecting strings with variables containing arrays:

    • $var = 'My name is' . $user['name'];
    • $var = "My name is" . $user['name'];
    • $var = "My name is {$user['name']}";
      Without the {} brackets this won't work properly.

That's why this line:

$query = mysql_query("... username ='$_POST[username]' AND password ='$_POST[password]'", $db) or die(mysql_error());

should be replaced with this:

$query = mysql_query("SELECT * FROM Username WHERE username ='".$_POST['username']."' AND password ='".$_POST['password']."'", $db) or die(mysql_error());

or this:

$query = mysql_query("SELECT * FROM Username WHERE username = \"{$_POST['username']}\" AND password = \"{$_POST['password']}\"", $db) or die(mysql_error());

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.