Menu
Community /Pin to ProfileBookmark
@NogDogAug 06.2005 — #
Possibly, but if the error is important, do you want it to?
Here's a quick re-write that may help clear some things up and catch any nastiness before it gets too far along in the script. I wrapped all my comments and a question in "# >>> comment <<<".
Checking query
Hi, I’m putting the finishing touches on a login script, which searches for the given username in the mysql database, and checks if the password matches. If the password matches it redirects to the members area, otherwise it redirects back to the login page.
However, if the username is not a correct username, it prints out an error instead of redirecting to the loginpage again. How can I stop it producing an error if it can’t find the username in the database?
This is part of the login script’s source:
[code=php]
$server=mysql_connect($host,$user,$pass);
mysql_select_db($db_name);
$usernamea=$_POST[‘username’];
$passworda=$_POST[‘password’];
$query=”SELECT password FROM users WHERE username=”$usernamea””;
$result=mysql_query($query);
if($result)
{
$result=mysql_result($result,0);
if($result==$passworda)
{
$query=”UPDATE users SET online=’true'”;
mysql_query($query);
redirectPage(“http://www.google.com”);
}
else
{
redirectPage(“loginpage.php?redir=2”);
}
}
else
{
redirectPage(“loginpage.php?redir=1”);
}
Sign in
to post a comment6 Comments(s) ↴
0
@NogDogAug 06.2005 — #I think I may have just found the answer in another thread. I read that '@' suppresses error reporting - does that mean if I change it to
[code=php]
$result=@mysql_result(mysql_query($query),0)
[/code]
...it will stop the error reporting and just redirect as planned?[/QUOTE]
Possibly, but if the error is important, do you want it to?
Here's a quick re-write that may help clear some things up and catch any nastiness before it gets too far along in the script. I wrapped all my comments and a question in "# >>> comment <<<".
[code=php]
<?php
$server=mysql_connect($host,$user,$pass) or
die("Unable to connect to database server"); # >>> just in case <<<
mysql_select_db($db_name) or
die("Unable to connect to database: " . mysql_error()); # >>> ditto <<<
# >>> make sure we got some data in both fields <<<
if(!empty($_POST['username']) and !empty($_POST['password']))
{
$usernamea=$_POST['username'];
$passworda=$_POST['password'];
# >>> note, password is reserved MySQL function name, so back-quote
# the column named password. In fact, just always back-quote column
# and table names, just in case. Also, you can check for username and
# password match all in one step <<<
$query="SELECT * FROM users WHERE username='$usernamea' AND password='$passworda'";
$result=mysql_query($query);
# >>> make sure query worked and we got exactly one match <<<
if($result and mysql_num_rows($result) == 1)
{
# >>> added WHERE clause so we only update this user <<<
$query="UPDATE users SET online='true' WHERE username='$usernamea'";
mysql_query($query); # >>> what happens if this fails? Does it ever get unset? <<<
redirectPage("http://www.google.com");
}
else
{
redirectPage("loginpage.php?redir=2");
}
}
else
{
redirectPage("loginpage.php?redir=1");
}
?>
[/code]