尝试从php中的表单中提取用户登录数据时代码无效

Question

I created a registration form that works fine in php for a project I am undertaking. I attempt to use another form, a login form in which to pull the username and password data from the user to verify it against the database. However I am getting parsing errors and other errors. I haven't started validation yet as I haven't got the basics in this ready.

I don't think I'm going about this the right way or if it's just a silly mistake.

    <EDIT Remove Important Info>


  // Check connection
    if (mysqli_connect_errno())   {  
    echo "Failed to connect to MySQL: " . mysqli_connect_error(); }


     if (isset($_SESSION['logged'])){ //already logged in   
     //$url= 'X'; // any page
        exit(); //ends script if user already logged in

     } else { //not logged in or submitted

        }


       $user_name = mysqli_real_escape_string($con,$_POST['username']);
       $pass = mysqli_real_escape_string($con,$_POST['password']);
    $notify="";
    if(isset($_POST['notify_box'])){ $notify = $_POST['notify_box'];




    $query=mysqli_query($con,"SELECT * FROM `websiteusers` WHERE username ='$user_name' AND password ='$pass'");

     $count = $mysqli_num_rows($query); //checks db
     $row = mysqli_fetch_array($query);

     if($count==0){ //db empty
      echo "Sorry, password and username not in db. Click here to try again.";

    }

    else{ // pw and un match, user login success
    $_SESSION['logged']=1; //start session
    $_Session['username']=$user_name; //session data
    }
    // } // opening brace for this was not found
    mysqli_close($con);
    exit();
    } // opening brace for this was not found 


?>

---

• And here is a jsFiddle of my HTML form

Answer 1

Edit

I found this in your form

<input name="user_name" type="varchar" > 

which should be

<input name="user_name" type="text">

Also, use this

$pass = mysqli_real_escape_string($con,$_POST['pass']); 

instead of

$pass = mysqli_real_escape_string($con,$_POST['password']);

yet I'm unsure about the password line, since you were using md5 and now just plain text.

You may have to set it back to:

$pass=md5($_POST['pass']);

---

There are a few issues with your code.

You have a missing quote at the end of '$user_name

WHERE username ='$user_name

Which needs to be changed to:

WHERE username ='$user_name'

as well as a missing semi-colon at the end of your query. $query=mysqli_query("SELECT....

And this (for one thing) $username=form($_POST['user_name']); is invalid, since form would be considered a function.

Use $username=$_POST['user_name']; or better yet:

$username=mysqli_real_escape_string($con,$_POST['user_name']);

A missing semi-colon at the end of $password=md5($_POST['pass'])

A missing $con at the beginning of the query.

Which is included in the complete rewrite below.

Line rewrite:

$query=mysqli_query($con, "SELECT * FROM `websiteusers` WHERE username ='$user_name' AND password ='$pass'" );

Plus, I noticed you're storing passwords using md5. It's no longer recommended to use this. Do look into using PHP's password function

Complete rewrite:

N.B.: The $url variable has not been defined anywhere else, so I'm unsure of its functionality. Plus there were two unused ending braces } at the end of your code, so I commented those out, along with the exit();

You may also be closing your DB connection prematurely with the placement of mysqli_close($con); should you be faced with another error message. I left it in place, but commented out and then moved at the end of the script.

Please give this a try, hoping things will fall into place as they should.

<?php
    // Create connection
     $con=mysqli_connect("X","X","X","X");
     session_start(); //starts  users session

     // Check connection
    if (!$con) {
        die('Connect Error: ' . mysqli_connect_errno());
    }

     //echo "1 record added";

     if (isset($_SESSION['logged'])){ //already logged in   
     $url= 'http://danu6.it.nuigalway.ie/sm4business/browse.html'; // any page
        exit(); //ends script if user already logged in

     } else { //not logged in or submitted

        $username=mysqli_real_escape_string($con,$_POST['user_name']);
        $pass=md5($_POST['pass']);

     } // mysqli_close($con); // may be being closed prematurely.

    $query=mysqli_query($con,"SELECT * FROM `websiteusers` WHERE username ='$user_name' AND password ='$pass'");

     $r = $mysqli_num_rows($query); //checks db
     $row = mysqli_fetch_array($query);

     if($r==0){ //db empty
      echo "Sorry, password and username not in db. Click here to try again.";

    }

    else{ // pw and un match, user login success
    $_SESSION['logged']=1; //start session
    $_Session['username']=$user_name; //session data
    }
    // } // opening brace for this was not found
    // exit();
    // } // opening brace for this was not found

    mysqli_close($con); // moved here

 ?>