Php Login & Mysql

Question

Im trying to make a simply login page but it says.

Parse error: syntax error, unexpected '$dbpassword' (T_VARIABLE) in /home/speedmin/public_html/login.php on line 19

Here is my code for the php script:

<?php

session_start();

$username = $_POST['username'];
$password = $_POST['password'];

if($username&&$password){
    $connect = mysql_connect("localhost","root","code") or die("Kunne ikke finde databasen");
    mysql_select_db("dbname") or die("Kunne ikke finde databasen");

    $query = mysql_query("SELECT * FROM users WHERE username='$username'");

    $numrows = mysql_num_fields($query);

    if($numrows){
        while($row = mysql_fetch_assoc($query)){
            $dbusername = $row['username']
            $dbpassword = $row['password']
        }

        if($username==$dbusername&&md5($password)==$dbpassword){
            echo"You are logged in";
            $_SESSION['username'] = $username;
        }
        else {
            echo"Din kode er forkert";
        }
    }
    else{
        die("Der er ingen bruger der hedder det");}
}
else{
    die("Skriv venligst din bruger & kode");
}

?>

Hope you can help, sry this is maybe a stupid question but im not so good to php.

I cant see whats wrong with the line so :(

Found a solution. :D

<?php

session_start();

$username = $_POST['username'];
$password = $_POST['password'];

if($username&&$password){
    $connect = mysql_connect("localhost","root","password") or die("Kunne ikke finde databasen");
    mysql_select_db("db") or die("Kunne ikke finde databasen");

    $query = mysql_query("SELECT * FROM users WHERE username='$username'");

    $numrows = mysql_num_fields($query);

    if($numrows){
        while($row = mysql_fetch_assoc($query)){
            $dbusername = $row['username'];
            $dbpassword = $row['password'];
        }

        if($username==$dbusername&&$password==$dbpassword){
            echo"Du logget ind";
            @$_SESSION['username'] = $username;
        }
        else {
            echo"Din kode er forkert";
        }
    }
    else{
        die("Der er ingen bruger der hedder det");}
}
else{
    die("Skriv venligst din bruger & kode");
}

?>

You are missing `;` at the end of both `$dbusername = $row['username']` and `$dbpassword = $row['password']` — Epodax, Feb 17 '16 at 08:04
please refrain from using mysql_, which is deprecated and in PHP7 removed. use mysqli_ or PDO instead, and learn about SQL-injections - your code is quite vulnerable. — Franz Gleichmann, Feb 17 '16 at 08:38

score 1 · Accepted Answer · edited May 23 '17 at 10:28

1

Because you forgot ;. It should be:

while($row = mysql_fetch_assoc($query)){
  $dbusername = $row['username'];
  $dbpassword = $row['password'];
}

But I would also suggest that you use mysqli_* instead of deprecated mysql_* API.

Don't also give the user the idea that the username they entered are correct or not. So I make a shorter conditions for your case.

<?php

  session_start();

  /* ESTABLISH CONNECTION TO YOUR DATABASE */
  $con = new mysqli("localhost", "root", "code", "dbname");

  /* CHECK CONNECTION */
  if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
  }

  if(isset($_POST["username"], $_POST["password"])){ /* IF BOTH ARE SET */

    $password = md5($_POST["password"]); /* HASH THE SUBMITTED PASSWORD */ 

    $stmt = $con->prepare("SELECT username, password FROM users WHERE username = ? AND password = ?"); /* PREPARE YOUR QUERY */
    $stmt->bind_param("ss", $_POST["username"], $password); /* ? WILL BE REPLACED WITH THESE TWO VARIABLES RESPECTIVELY; s STANDS FOR STRING TYPE */
    $stmt->execute(); /* EXECUTE YOUR QUERY */
    $stmt->store_result(); /* STORE THE RESULTS */
    $numrows = $stmt->num_rows; /* GET THE NUMBER OF RETURNED ROWS */
    $stmt->bind_result($dbusername, $dbpassword); /* BIND THE RESULT TO THESE TWO VARIABLES ACCORDINGLY */
    $stmt->fetch(); /* FETCH RESULTS */
    $stmt->close(); /* CLOSE PREPARED STATEMENT */

    if($numrows > 0){ /* IF FOUND MATCH */
      echo "You are logged in";
      $_SESSION['username'] = $dbusername;
    }
    else {
      echo"Din kode er forkert";
    }

  }
  else {
    die("Skriv venligst din bruger & kode");
  }

?>

And password_hash is a more secure way to encrypt password rather than md5(). If you have a time, take also a look at it.

edited May 23 '17 at 10:28

Community

1
1

answered Feb 17 '16 at 08:04

Logan Wayne

6,001
16
31
49

Hey Logan. what shall i write at username = ? and at password = ? – Bastian Mødekjær Feb 17 '16 at 08:22
`?` will be replace in the next line `$stmt->bind_param("ss", $_POST["username"], md5($_POST["password"]));` respectively. – Logan Wayne Feb 17 '16 at 08:25
@BastianMødekjær - because I used `$con` in your prepared statement. But we established your connection to `$conn` variable. Please take a look at the updated answer. Just replaced `$conn` with just `$con` – Logan Wayne Feb 17 '16 at 08:28
i changed the con to conn but now it say `Strict Standards: Only variables should be passed by reference in /home/speedmin/public_html/login.php on line 17` – Bastian Mødekjær Feb 17 '16 at 08:31
@BastianMødekjær it was because we tried to bind `md5($_POST["password"])`. But look at the updated answer, we separate the declaration and hashing of the password before we bind it to the query. – Logan Wayne Feb 17 '16 at 08:33
@BastianMødekjær - you can just always copy and paste it to your work. And tweak a little if you want. ;) – Logan Wayne Feb 17 '16 at 08:39
Mr wayne. I got a problem now. The php code works. But dont work with the my-sql database. I have setup a user named "ghost" and the code is "1234" but it dosent work – Bastian Mødekjær Feb 17 '16 at 09:25
@BastianMødekjær What did you create? Is it a privilege or just data stored in a table? – Logan Wayne Feb 17 '16 at 09:39
Its data stored in a table on my sql :D – Bastian Mødekjær Feb 17 '16 at 12:47

score 0 · Answer 2 · answered Feb 17 '16 at 08:05

 if($numrows){
    while($row = mysql_fetch_assoc($query)){
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
    }

    if($username==$dbusername&&md5($password)==$dbpassword){
        echo"You are logged in";
        $_SESSION['username'] = $username;
    }
    else {
        echo"Din kode er forkert";
    }
}

missing ;

score 0 · Answer 3 · answered Feb 17 '16 at 08:10

0

if(isset($userName) & & isset($password)) { Rest of code here. Should work. Why are you looping through? Just use an if statement. if($username == $row['userName'] & & md5($password) == $row['password'])

answered Feb 17 '16 at 08:10

Mike Castro

19
6

score 0 · Answer 4 · answered Feb 17 '16 at 08:21

try this code ..i m using this way to login //php

if(isset($_POST['sbtLogin'])){

        extract($_POST);
        $email = isset($email) ? $email : '';
        $password = isset($password) ? md5($password) : '';
        $remember = isset($remember) ? $remember : 'n';
        if($email != '' && $password != '')
        {
            $selUser = mysql_query('SELECT id,firstName FROM tbl_users WHERE email = "'.$email.'" AND password="'.$password.'" LIMIT 1');
            if(mysql_num_rows($selUser)>0){
                $fetchUsr = mysql_fetch_assoc($selUser);
                $_SESSION['sessUserId'] = $fetchUsr['id'];
                $_SESSION['sessUserName'] = $fetchUsr['firstName'];

                                echo 'Successfully loggedin';
            }
            else{
            $msg = 'Invalid Username or password';

            }
        }
        else{

                echo 'Fill all values properly';
        }

    }

Php Login & Mysql

4 Answers4