登录php脚本

Question

I have here a login script.I removed from it the database username/password to post it on stack.My problem is that it tells me everytime I write a username and a password(even when they are correct) that the password and username are invalid.I obviously used select *from ........ and then put a variable $rows to count the affected rows,but it's value is 0 everytime and I am not able to log in.

<h1>Log in</h1>
<form action="" method="post">

    Username:<input type="text" name="username" placeholder="username" value=""/> <br />

    Password:<input type="password" name="password" placeholder="*******" value=""/> <br />

    <input type="submit" name="submit" value="Log In" />
             <br />


</form>





    <?php

    $error=''; 
    if (isset($_POST['submit'])) {
    if (empty($_POST['username']) || empty($_POST['password'])) {
    $error = "Username or Password is empty";
    echo $error;
    }
    else
    {

    $username=$_POST['username'];
    $password=$_POST['password'];

    $connection = mysql_connect("mysql.hostinger.ro", "_patr0", "  ");

    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);

    $db = mysql_select_db("_ppl", $connection);



    $query = mysql_query("select * from people where pw='$password' AND username='$username'", $connection);


    $rows=mysql_num_rows($query);

    if ($rows==1) {


    /*$_SESSION['login_user']=$username;*/ // Initializing Session


    echo 'You are logged in';
    } else {
    $error = "Username or Password is invalid";
    }
    echo $error;
    mysql_close($connection); // Closing Connection
    }
    }
    ?>

Answer 1

Yes I am sure.David I stored the passwords using aes_encrypt('$password','text')

This could be your problem, when you are running your mysql query here you are trying to match a plain text password from the user input, but you store them as encrypted strings. You need to encrypt the password in your SQL query.