无法登录我的网站工作

Question

I updated my code and used mysqli this time I don't get any more errors But it doesnt let me log in now.

<?php
$host = 'my host';
$user = 'me';
$PW = 'my password';
$dB = 'login';
$table = 'members';
$field = 'username';    
/* Create a new mysqli object with database connection parameters */
$mysqli = new mysqli($host, $user, $PW, $dB);
if(mysqli_connect_errno()) {
    echo "Connection Failed: " . mysqli_connect_errno();
    exit();
}    
//Grab User submitted information
$name = $_POST['username']; //login name
$pass = $_POST['password'];  //login password    
/* Create a prepared statement */
if($stmt = $mysqli -> prepare("SELECT f_name FROM $table WHERE $field=?
AND password=?")) {
    /* Bind parameters
    s - string, b - blob, i - int, etc */
    $stmt -> bind_param("ss", $name, $pass);
    /* Execute it */
    $stmt -> execute();        
    /* Bind results */

    $stmt -> bind_result($result);

    /* Fetch the value */

    $stmt -> fetch();

    if ($result == NULL) {
        echo "That combo of username and password is wrong!";
    }
    else{
        echo "Hello " . $result;
    }
    /* Close statement */
    $stmt -> close();
}
/* Close connection */
$mysqli -> close(); 
?>

I think it works now but even when I enter the correct ID & PW it says I didn't. I don't know why it would do this.

Answer 1

your problem is

 $_POST["usersname"]

is not defined.

when you use the $name in your query use this mysql_real_escape_string($name) .

if this is your code , its catastroph for sql injections . you should change to mysqli or PDO