Simple PHP/MySQL - Fresh Eyes Needed
Hey Hey,
This is driving me nuts, and I know it's something stupid... All I need is a fresh set of eyes to look it over and tell me where I'm FUBARing it.
connect.php
Code:
<?
$user = "XXXXX";
$pass = "XXXXX";
$db = "XXXXXX";
$myserver = "XXXXX";
$connect = mysql_connect($myserver, $user, $pass) of die("Connect");
$select_db = mysql_select_db($db) or die("DB Selection");
?>
login.php
Code:
<?
session_start();
include 'inc/connect.php';
if ( $_POST['username'] != "" AND $_POST['password'] != "" ) {
$username = $_POST['username'];
$password = md5($_POST['password'];
$username = htmlspecialchars($username);
$username = stripslashes($username);
$query = 'SELECT * FROM tblUsers WHERE userName = "' . $username . '" AND userPassword = "' . $password . '" LIMIT 1';
$result = mysql_query($query);
$numResult = mysql_num_rows($result);
if ( $numResult == 1) {
$userInfo = mysql_fetch_array($result);
$_SESSION['sessionID'] = $userInfo['userID'];
header("Location: http://www.xxx.ca/next.php");
}
}
else {
header("Location: http://www.xxx.ca/index.php");
}
?>
It should be going to the next page but it does nothing... I just get a blank screen.... I've even put echo's after ever single line of code from line 1 to the end... and none of the echo's ever show up.... I just keep getting
Code:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252"></HEAD>
<BODY></BODY></HTML>
Peace,
HT
Re: Simple PHP/MySQL - Fresh Eyes Needed
Corrected versions as I see 'em below:
Code:
<?PHP // Always use <?PHP to open tags, there's a reason PEAR compliance requires it.
$user = "XXXXX";
$pass = "XXXXX";
$db = "XXXXXX";
$myserver = "XXXXX";
$connect = mysql_connect($myserver, $user, $pass) or die("Connect");
$select_db = mysql_select_db($db) or die("DB Selection");
?>
Code:
<?PHP
session_start();
include "inc/connect.php";
if ( !empty($_POST['username']) && !empty($_POST['password']) )
{
$username = $_POST['username'];
$password = md5($_POST['password'];
$username = htmlspecialchars($username);
$username = stripslashes($username);
$query = "SELECT * FROM tblUsers WHERE userName = '".$username."' AND userPassword = '".$password."'";
$result = mysql_query($query);
$numResult = mysql_num_rows($result);
if ( $numResult == 1)
{
$userInfo = mysql_fetch_array($result);
$_SESSION['sessionID'] = $userInfo['userID'];
header("Location: http://www.xxx.ca/next.php");
exit;
}
}
else
{
header("Location: http://www.xxx.ca/index.php");
exit;
}
?>
If you can read this, PHP is not being parsed correctly.
Personally, I've long been a fan of PEAR::DB both for portability across backends, as well as its error handling. There are other steps I would personally take here to ensure that the data is being sanitized, but I've covered that here before. :)
