Login not working

[monarch_684]

Can anyone tell me why this might not be working. It stops if the uname is not valid, doesn't stop if the pwd and uname do not match. It just reads the uname and logs in without the pwd.

        $uname = $_POST['uname'];
    $pwd = $_POST['pwd'];
    $epwd = md5('$pwd');
    
    printConnect();
    
    $query = "SELECT * FROM login";
    $result = mysql_query($query)
        or die ("Couldn't query data" . mysql_error());
        
    $row = mysql_fetch_assoc($result);
    
    if($uname != $row['username']) {
        $_SESSION['error'] = 'Username does not exist!!';
        header('Location: index.php');
    }
    else {        
        $query = "SELECT * FROM login WHERE username = '$uname'";
        $result = mysql_query($query)
            or die ("Couldn't query data" . mysql_error());
        
        $row = mysql_fetch_assoc($result);
        
        $pwdc = $row['password'];
        
        if($epwd != $pwdc) {
            $_SESSION['error'] = 'Username does not exist!!';
            header('Location: index.php');
        }
        else {
            $_SESSION['loggedIn'] = TRUE;
            $_SESSION['uname'] = $uname;    
        }
        header('Location: index.php');
    } 

[MrCoder]

$query = "SELECT * FROM login"; 

Shouldn't that look for the user name?

$result = mysql_query("SELECT * FROM login WHERE username = '".mysql_real_escape_string($uname)."' LIMIT 1");

if(mysql_num_rows($query) == 1)
{
    // Username found
    $row  = mysql_fetch_assoc($result);
    $pwdc = $row['password'];
    
    if($epwd == $pwdc)
    {
        // Password matches
    } else {
        // Password mismatch
    }
} else {
    // Username not found
} 

[bokeh]

$query = "SELECT * FROM login"; 

What sort of a query is that? Why don't you select what you are looking for.

[monarch_684]

The username part works fine. It is the password part I need help with.

[bokeh]

It only works because you have just one entry in the table. Run a proper query that checks the user and password in one hit.

[monarch_684]

This is what I changed it to. It still don't work.

$query = "SELECT * FROM login WHERE username= '$uname'";
    $result = mysql_query($query)
        or die ("Couldn't query data" . mysql_error());
        
    $row = mysql_fetch_assoc($result);
    
    if($uname != $row['username']) {
        $_SESSION['error'] = 'Username does not exist!!';
        header('Location: index.php');
    }
    else {
        if($epwd != $row['password']) {
            $_SESSION['error'] = 'Username and password do not match!!';
            header('Location: index.php');
        }
        else {
            $_SESSION['loggedIn'] = TRUE;
            $_SESSION['uname'] = $uname;    
        }
        header('Location: index.php');
    } 

[MrCoder]

Did you try the code I posted?

[monarch_684]

Yeah, it don't work at all. It says username doesn't exist when I submit.

[monarch_684]

Just on a whim I tried something, uploaded the script to the production server. Go figure, it works now with the exception of I have to log in twice for some reason and header() is not working.

$query = "SELECT * FROM login WHERE username= '$uname'";
        $result = mysql_query($query)
            or die ("Couldn't query data" . mysql_error());
        
    $row = mysql_fetch_assoc($result);
    
    if($uname != $row['username']) {
        $_SESSION['error'] = 'Username does not exist!!';
        header('Location: index.php');
    }
    else {
        if($epwd != $row['password']) {
            $_SESSION['error'] = 'Username and password do not match!!';
            header('Location: index.php');
        }
        else {
            $_SESSION['loggedIn'] = TRUE;
            $_SESSION['uname'] = $uname;    
        }
        header('Location: index.php');
    }