How to make an else condition work in PHP? - php

Question

I have written PHP code with many nested if conditions. I just want to display an alert for an exceptional condition along with the if conditions.
Here is my source code:
$username = $_POST['username'];
$password = $_POST['password'];
if (!empty($username) && !empty($password)) {
$query ="SELECT * FROM user where username='.$username.' AND pass='.$password.'";
$row = mysql_fetch_array($query);
$counted = mysql_num_rows($query);
if (($counted === 1) &&
($row['username'] === $username) &&
($row['password'] === $password))
{
session_destroy();
session_start();
echo "message";
} else {
do_alert("Exceptional alert");
}
} else {
do_alert("Exceptional alert");
}
These two else conditions are not working. I don't know really where my mistake is.

Answer 1

I think it may have to do with your do_alert down in your code. Follow me through the code.
$username = $_POST['username'];
$password = $_POST['password'];
if (!empty($username) && !empty($password)) { // if not empty
$query =""; // this is an empty query
$row = mysql_fetch_array($query); // returns nada
$counted = mysql_num_rows($query); // gives nada back
if (($counted === 1) && ($row['username'] === $username) && ($row['password'] === $password)) { // completely useless at this point cause no row is returned
session_destroy();
session_start();
echo "message";
} else { // this will not be executed
do_alert("Exceptional alert");
}
} else { // this will be executed
do_alert("Exceptional alert"); // where is this function defined?
}
okay i commented on your code where it goes wrong. As you see it happens already on the first if, so it should return the last else. Since I dont know where your do_alert code is defined, my guess is that this is your error.
Try replacing it first with an echo like this: echo "I am a super duper evil monkey"; and see if that works.
edit
since you added your query now, i 'd like to point out as well that you should sanitize your input. This to make it more safe. However the term safe here is kind of irralevant, cause you re using an outdated mysql set. (mysqli / pdo are the ways to go now)
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
why? simple. Look at this!
$_POST['username'] = 'awesome';
$_POST['password'] = "' OR ''='";
it would turn up something then like this.
SELECT * FROM users WHERE user='awesome' AND password='' OR ''=''
And this would mean, everybody could log in, cause blank is always blank. Just as a headsup.
More information here: http://php.net/manual/en/function.mysql-real-escape-string.php
edit 2
// very first thing you do if you work with sessions, is actually starting it. you dont do this in your if else statement, cause you could not benefit of the session variable on a later stage on this page.
session_start();
// these variables come from a form with a form name, so we are going to do a check if indeed this came from that form.
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
if (!empty($username) &&
!empty($password)) {
$query ="SELECT name, password FROM user WHERE name='".$username."' AND password = '".$password."'";
$row = mysql_fetch_array($query);
$counted = mysql_num_rows($query);
if (($counted === 1) &&
($row['username'] === $username) &&
($row['password'] === $password)) {
echo "message";
} else {
echo "no entrees found";
}
} else {
echo "failed to input some variable";
}
I cleaned some up in my own words, you may have to fiddle with the query, and further i fixed it a bit since you didnt use the session appropiately.
Now where it echo's the message, you should set a session variable, that you can destroy later when you log out. A session variable you can call in the session itself, on every page that has sessionstart() in it. Here you can check if it excists, if so then you are logged in. I hope this helps you out.