[RESOLVED] retrieve username and password

[acemo]

the script to create the database+table+first user:

<?php
$database = "acemo";
$first_user = "username";
$first_password = "password";
mysql_connect("localhost","root","") or 
       die("<p>Mysql error when trying to connect to mysqlserver error is " . mysql_error() . "</p>");
echo "<p>connected to mysql server</p>";
$query = "CREATE DATABASE $database";
$result = mysql_query($query) or die("<p>Mysql error when trying to create database is " . mysql_error() . "</p>");
echo "<p>Database $database created</p>";
$query = "USE $database";
$result = mysql_query($query) or die("<p>Mysql error when trying to use database is " . mysql_error() . "</p>");
echo "<p>Using database $database</p>";
$query = 'CREATE TABLE users('.
    'user_id INT NOT NULL AUTO_INCREMENT, '.
    'username varchar(30) NOT NULL, '.
    'password varchar(50) NOT NULL, '.
    'PRIMARY KEY(user_id))';
$result = mysql_query($query) or die("<p>Mysql error when trying to create table is " . mysql_error() . "</p>");
echo "<p>Created table users</p>";
$query = "INSERT INTO users (username, password) VALUES('$first_user', '" . sha1("$first_password") . "')";
$result = mysql_query($query) or die("<p>Mysql error when trying to create first user is " . mysql_error() . "</p>");
echo "<p>Created first user with as username '$first_user' and as password '$first_password'</p>";
echo "<p><a href='../index.php'>Home</a></p>";
?>

the table:

mysql> SELECT * FROM users;
+---------+----------+------------------------------------------+
| user_id | username | password                                 |
+---------+----------+------------------------------------------+
|       1 | username    | 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 |
+---------+----------+------------------------------------------+
1 row in set (0.00 sec)

the script to check the username and password:

    $query = "SELECT * FROM users WHERE username=" . $_POST['username'] . " AND " .
            "password=" . sha1($_POST['password']);
    $result = mysql_query($query) or die("ERROR: " . mysql_error()); 

the error:

ERROR: Unknown column '5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8' in 'where clause'

what am i doing wrong?

[NogDog]

You need to quote the values:

 $query = "SELECT * FROM users WHERE username='" . $_POST['username'] . "' AND " .
            "password='" . sha1($_POST['password']) ."'";
    $result = mysql_query($query) or die("ERROR: " . mysql_error()); 

[acemo]

thanks it works