MySQL/ PHP/PHPMydamin error - php

Question

I'm VERY new to PHP and MySql and like most beginners I'm trying to make use of things I'm learning so I'm trying to make a simple login/logout system.
I've downloaded WAMP,made my database in PHPMyAdmin and my table etc however I cannot get my PHP code to recognise the data in the database, I simply get 'Query failed'!I can certainly connect the database,and I don't believe the problem is with the database but my login file!I've looked at loads of different tutorial but I still can't get this to work.I'd really appreciate if anyone could point me in the right direction!
If anyone wants to play around with my code thats fine the fields I have in the database are: id, username, password, first name, last name (id is a primary key with auto increment)
My login file is
<?php
//require 'core.inc.php';
//echo $current_file;
if (isset($_POST['username'])&& isset ($_POST['password'])){
$username= $_POST['username'];
$password= $_POST['password'];
if (empty ($username)&&empty ($password)){
echo 'supply username and password';
}
$query = "SELECT * FROM 'test1' WHERE 'username'='$username'AND 'password'='$password'";
$result= mysql_query($query);
if($result) {
if(mysql_num_rows($result) > 0) {
//Login Successful
session_regenerate_id();
$member = mysql_fetch_assoc($result);
$_SESSION['SURNAME_NAME'] = $member['username'];
$_SESSION['SESS_ID'] = $member['password'];
session_write_close();
exit();
}else {
//Login failed
echo 'user name and password not found';
$errflag = true;
if($errflag) {
$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
session_write_close();
exit();
}
}
}else {
die("Query failed");
}
}
?>
<form method="POST">
Username: <input type = "text" name="username"> Password: <input type ="password" name="password">
<input type="submit" value="Log in">
</form>
and my connect data base file is(I have removed my password on purpose) :
// assign the host user name and database name to variables
$db_host = "localhost";
$db_username = "";
$db_password = "";
$db_name = "";
session_start();
// connect to database, if not send error message
mysql_connect("$db_host", "$db_username", "$db_password") or die ("Could not connect to MySQL.");
// check database exists, if not send error message
mysql_select_db("$db_name") or die ("No database.");
// if sucessful connection etc print out the following!
//echo("Successful connection established.");
?>

Answer 1

$query = "SELECT * FROM test1 WHERE username = '$username' AND password = '$password'";
or
$query = "SELECT * FROM `test1` WHERE `username` = '$username' AND `password` = '$password'";

Answer 2

Change die('....'); with echo mysql_errno() . ": " . mysql_error(); exit(); to see whats going on. Also do not use this example code in your real application. It's not secure since it doesn't validate input.
At least do something like:
$sql = "SELECT * FROM bla WHERE x = '".mysql_real_escape_string($_POST['x'])."'";

Answer 3

Alot of problems! here is a fixed code to do it right:
ini_set('display_errors', 1);
$database="******";
$host="localhost";
$table1="install_crawler";
$data_username="**********";
$data_password="*********";
$linkos = mysql_connect("$host", "$data_username", "$data_password") or die('no connection -'.mysql_error());
mysql_select_db("$database") or die('no connection -' .mysql_error());
session_start();
if (isset($_POST['username'])&& isset ($_POST['password'])) {
$username= mysql_real_escape_string($_POST['username']);
$password= mysql_real_escape_string($_POST['password']);
if (empty ($username)&&empty ($password)) { echo 'supply username and password <br />'; }
else {
$query = "SELECT * FROM $table1 WHERE username='$username' AND password='$password'";
$result = mysql_query($query) or die ( "Query problem!".mysql_error());
}
}
if(isset($result)) {
$member = mysql_fetch_row($result);
if(isset($member[0])) //0 - is the first col of the table, 1 is the second etc....
{
//Login Successful - do your stuff - call your functions.
echo "SUCCESS LOGIN!".$member[0];
exit;
}
else
{
//Login failed - do your stuff - call your functions.
echo 'User-name Or Password NOT Correct! Try agian: <br />';
echo '<form method="POST">
Username: <input type = "text" name="username"> Password: <input type ="password" name="password">
<input type="submit" value="Log in">
</form>';
exit;
}
}
else
{
echo '<form method="POST">
Username: <input type = "text" name="username"> Password: <input type ="password" name="password">
<input type="submit" value="Log in">
</form>';
}
Note:
you should use *.mysql_error()*. and add it to your DIE() statements.
don't use single quote while typing the table name & col's.
to check if a query is ok use : *$result = mysql_query($query) or die ( "Query problem!".mysql_error());*
use mysql_real_escape_string() to avoid and escape SQL special chars. (IMPORTANT).
See the rest in the edited code.
Have fun!

Answer 4

$query = "SELECT * FROM test1 WHERE username='".$username."'AND password='".$password."'";
$result= mysql_query($query);
I always always split my variables out from strings and append them together like above.
You may want to start with the following test after using the above
if($result) echo "success";
else echo mysql_error();
Your mysql code would be sound then. I shall point you in the direction that PHPMyAdmin has a create php code button if you create an sql statement using the sql feature.

Answer 5

I noticed that your 'form' tags in the example do not contain an Action parameter, perhaps this is a problem.. If it is intentional then disregard.
You should put action="siteexample.php" as the page where the forum data gets processed.
Does this help?