mysql_fetch assoc拒绝返回密码行。 需要帮助

Question

The username row comes out perfectly but the password row refuses to come through.

I am at a loss here.

Does anybody know what the solution is?

here is my code::

<?php

//Mass include file
include ("includes/mass.php");

//This is the login script
//Grabbing the login values and storing them

$username = $_POST['username'];
$password = $_POST['password'];
$submit   = $_POST['submit'];

if (isset($submit))
{
    if (strlen($username)<2) // put || ($username==(same as value on the database)
    {
        echo ("<br>You must enter a longer username</br>");
    }
    elseif (strlen($password)<=6)
    {
        echo ("<br>You must enter a longer password<br>");
    }
    else
    {
        $sql = "SELECT * FROM user WHERE username = '$username'";
        $query = mysql_query($sql);
        $numrows = mysql_num_rows($query);

        if ($numrows != 0)
        {
            while ($row = mysql_fetch_assoc($query))
                $dbusername = $row['username'];
            $dbpassword = $row['password'];         

            if ($dbusername == $username && $dbpassword == $password)
            {
                echo "your in!";
            }
            else
            {
                echo "Wrong info";
            }
        }
        else
        {
            die ("That username doesnt exist");
        }
    }
}

?>

Answer 1

You have a missing parenthesis after the while.

Both

$dbusername = $row['username'];
$dbpassword = $row['password'];      

Should be within the while loop which is not the case.

You need to do something like:

while ($row = mysql_fetch_assoc($query)) {

    $dbusername = $row['username'];
    $dbpassword = $row['password'];           

    if ($dbusername == $username && $dbpassword == $password) {
        echo "your in!";
    }
....

Adding to what Matthew has said:

You should not show messages like "username doesnt exist" to the user. This provides valuable information to a hacker who wants to break in. In case the user provides a wrong username and/or wrong password, you should display "invalid username or password".