I am creating a website where there will be about 125 users. They will each be given their username and password (actually, all passwords will be the exact same, only the username will vary). So there is no registration step, they just go to the website they are given, where they will see a login form with fields for username and password, enter in what they were given, and they should be able to enter the password protected area. I'm connecting to the database just fine, but I think my problem lies in the query. Below is my PHP code (with placeholders for the database information), as well as a screen shot of the table in my database (which only has 2 users in it right now, for testing purposes). If anyone is able to help me, that would be greatly appreciated!
<?php
//Start session
session_start();
//Include database connection details
require_once('config.php');
//Array to store validation errors
$errmsg_arr = array();
//Validation error flag
$errflag = false;
//Connect to mysql server
$link = mysql_connect('host','username', 'password');
if(!$link) {
die('Failed to connect to server: ' . mysql_error());
}
//Select database
$db = mysql_select_db('database');
if(!$db) {
die("Unable to select database");
}
//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}
//Input Validations
if($login == '') {
$errmsg_arr[] = 'Login ID missing';
$errflag = true;
}
if($password == '') {
$errmsg_arr[] = 'Password missing';
$errflag = true;
}
//If there are input validations, redirect back to the login form
if($errflag) {
$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
session_write_close();
header("location: login-form.php");
exit();
}
//Create query
$sql = "SELECT * FROM users WHERE user = 'username' AND pass = 'password'";
$result = mysql_query($sql);
//Check whether the query was successful or not
if($result) {
if(mysql_num_rows($result) == 1) {
//Login Successful
$_SESSION['user'] = $username;
$_SESSION['pass'] = $password;
//$_SESSION['full_names'] = $full_names;
header("location: member-index.php");
exit();
}else {
//Login failed
header("location: login-failed.php");
exit();
}
}else {
die("Query failed");
}
?>THANKS!
[attachment deleted by admin]
