login form php code

Question

I have created a form with username and password and login button in html. I have created code for php but it is not able to check the condition for login successfull, below is the php code. It is satisfying all conditions except for login successfull. I guess there is some simple mistake in it and i am not able to find it, please help me.

<?php
        include_once('db.php'); 

        $username = mysql_real_escape_string( $_POST["username"] );
        $password = mysql_real_escape_string( md5($_POST["pass"]) );

        if( empty($username) || empty($password) )
            echo "Username and Password Mandatory ";
        else
        {
        $sql = "SELECT count(*) FROM users WHERE( username='$username' AND password='$password')";


        $res = mysql_query($sql);
        $row = mysql_fetch_array($res);

        if( $row[0] > 0 )
         echo "Login Successful";
        else
         echo "Failed To Login";
        }       
?>

Answer 1

Propably, you have to use the following command instead of $row[0] > 0:

mysql_num_rows($sql)

You can check the user like this:

if(mysql_num_rows($res)==1)
  echo "Login Successful";
} else {
  echo "Failed To Login";
}

Answer 2

You should directly check if the output of mysql_fetch_array() is not null nor false :

    $res = mysql_query($sql);
    if( $row = mysql_fetch_array($res) )
     echo "Login Successful";
    else
     echo "Failed To Login";
    } 

Regarding you overall code, there a some things that are clearly bad practices :

• mysql_* functions are deprecated since PHP5.5 and don't even exist since PHP7.0. Use the Mysqli class or PDO instead.
• Don't use MD5 to hash your users passwords, it's broken for years and years. Add salt for a better protection.
• Don't close you php tags. It's optional, and it will give you headaches if you try to include a php file that has a closing tag at the end.

That code is better :

<?php

include_once('db.php'); 

if( empty($_POST['username']) || empty($_POST['password']) ) 
    echo "Username and Password Mandatory ";
else {
    try {
        $db = new PDO("mysql:host=$dbHostname;dbname=$basename", $dbUsername, $dbPassword);
        $stmt = $db->prepare("SELECT * FROM users WHERE username = username AND password = password");
        $stmt->bindParam(':username', $_POST['username']);
        $stmt->bindParam(':password', md5($_POST['password']));  // I still urge you to pick a valid hash function ! This one is broken for ages !
        $stmt->execute();
    } catch (PDOException $e) {
        print "Erreur !: " . $e->getMessage() . "<br/>";
        die();
    }
    if (empty($row))
        echo "Failed To Login";
    else
        echo "Login Successful";
}