[Laertes]

Hi, I am new to PHP and MySQL but I decided that I would take on the challenge of creating a game and learn as I go. I have a nice layout and information for my pages, but when I try to login it displays the error "Please enter a username" and I think I have it set correctly to display that if the username field is left blank, but it displays even if I enter my username and password.

Here is the php code for index.php(equivalent to login.php).

Code:

<?php
session_start();
EOF;
$ip = ($_SERVER['HTTP_X_FORWARDED_FOR'])
    ?  $_SERVER['HTTP_X_FORWARDED_FOR']
    :  $_SERVER['REMOTE_ADDR'];
if(file_exists('ipbans/'.$ip))
{
die("<b><font color=red size=+1>Your IP has been banned, there is no way around this.</font></b></body></html>");
}
$dbhost = "mysql3.freehostia.com";
$dbname = "********";
$dbuser = "********";
$dbpass = "********";
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());
$dbhost = "mysql3.freehostia.com";
$dbname = "********";
$dbuser = "********";
$dbpass = "********";
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());
?>

and this is the form for the index.php page

Code:

<form name="login" method="post" action="authenticate.php">
  <table width="100%" border="0" align="center" cellpadding="2" cellspacing="0">
    <tr>
      <td width="50%"><b>Login</b></td>
      <td width="50%"><input name="login" type="text" class="textfield" id="login" /></td>
    </tr>
    <tr>
      <td width="50%"><b>Password</b></td>
      <td width="50%"><input name="password" type="password" class="textfield" id="password" /></td>
    </tr>
    <tr>
      <td width="50%">&nbsp;</td>
      <td width="50%"><input type="submit" name="Submit" value="Login" /></td>
    </tr>
  </table>
</form>

and this is the code for the authenticate.php

Code:

<?php

$dbhost = "mysql3.freehostia.com";
$dbname = "********";
$dbuser = "********";
$dbpass = "********";
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());

if(empty($_POST['username']))
{
	die("Please enter a username.");
}
$query = "SELECT `username`,`password` FROM user WHERE `username`='".$username."'";
$username."'";
$result = mysql_query($query);
if(mysql_num_rows($result)!=1)
{
	die('We don\'t have a user called '.$username.'. If this is your first visit to our website, you may need to <a href="../register.php">create an account</a>. Otherwise, check your spelling.');
}
while($record = mysql_fetch_assoc($result))
{
	if(md5($password)!=$record['password'])
	{
		die("You provided an incorrect password. Please try again.");
	}
}

?>

Thanks in advanced for any help given,
Laertes.

[de.monkeyz]

You're grabbing the wrong post value. You've given your input a name of "login" not "username". Either change the php to "login", or the input to "username".

Also.. you've just posted your db host, user and pass publicly. Now anyone can access it.

[Laertes]

oh crud didnt realize it, guess I gotta change the info...