Login script not working though the DB user name and password correct

Question

Index file:

/*<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

<html>
<head>

 <title>SMB Login</title>


</head>

<body>
<form name="form1" method="post" action="checklogin.php">
 -------begin -----
                <div class="panel-body">
                    <form accept-charset="UTF-8" role="form">
                    <fieldset>
                        <div class="form-group">
                            <input class="form-control" placeholder="E-mail" name="email" type="text" id="username">
                        </div>
                        <div class="form-group">
                            <input class="form-control" placeholder="Password" name="password" type="password" value="" id="password">
                        </div>
                        <div class="checkbox">
                            <label>
                                <input name="remember" type="checkbox" value="Remember Me"> Remember Me
                            </label>
                        </div> 
                        <input class="btn btn-lg btn-success btn-block" type="submit" value="Login"> 
                    </fieldset>
                    </form>
   ----------etc

The above script is my HTML code for login page, I have added the below PHP script for login. But everytime, i'm getting user name password is wrong though I 'm entering the right one.

checklogin.php --> source code

<?php

ob_start();
$host="mysql"; // Host name 
$username="admin"; // Mysql username 
$password="XXX"; // Mysql password 
$db_name="members_smb"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form 
$myusername=$_POST['username']; 
$mypassword=$_POST['password']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$username' and password='$password'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("username");
session_register("password"); 
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
ob_end_flush();
?>
*/

Please suggest me where I'm getting wrong?????

What is $count? Any errors thrown? Is your HTML page really completely commented out? You should format your code a bit more. — chris85
– chris85, Commented Jan 11, 2016 at 5:19
also as nobody has mentioned this I will. DON'T use mysql_* extension anymore. Use the mysqli_* extenstion or the PDO extension. As mysql_* is deprecated and in PHP 7.0 deleted. Also what you need to do is using prepared statements when handling user input, here your code is open to SQL-Injections. And I think you don't want some 12 year old kid who found a malicious SQL query to ruin your whole website/database. — BRoebie
– BRoebie, Commented Jan 11, 2016 at 8:56

Dylan James McGannon · Accepted Answer · 2016-01-11 05:19:56Z

2

In your SQL string you are inserting $username and $password but those variables don't exist. You have $myusername and $mypassword.

Change to:

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";

There is a lot more wrong with your code but this is the crux of your issue.

answered Jan 11, 2016 at 5:19

Dylan James McGannon

9641 gold badge7 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

chris85 Over a year ago

You are correct, but your answer has a typo. Those variables do exist they are DB credentials though, so no error is thrown but user data is not checked. mysql_connect("$host", "$username", "$password").

Dylan James McGannon Over a year ago

Ah, so they do! Well spotted.

Collectives™ on Stack Overflow

Login script not working though the DB user name and password correct

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related