sql if statment syntax help please - php

<?php
include 'dbc.php';
?>
<?php session_start();
$id = $_SESSION['user_id'];
//$update = Reminder1;
// $rt1 = Reminder1;
// $mm1 = Reminder1;
mysql_connect("localhost", "user", "pass") or die(mysql_error());
mysql_select_db("database") or die(mysql_error());
$data = mysql_query("SELECT reminder FROM users WHERE $id = id)")
or die(mysql_error());
if EXISTS (reminder == Reminder1)') {
echo("Update Your Pasword reset reminder page");
}
else {
echo("redirect to /home.php");
}
?>
can anyone help me out on why this is failing, would be great i have been working on this for a while and it feels like i am hitting brick walls lol. i am still in testing so the to echos will be edited soon as it is in working condition so ignore them lines for now i left it all in for examples sake.

Why is the MySQL extension (ext/mysql) discouraged from use?
<?php
session_start();
$id = $_SESSION['user_id'];
$DB = new PDO('mysql:dbname=database;host=localhost', 'user', 'pass');
$stmt = $DB->prepare('SELECT reminder FROM users WHERE id = ?');
$stmt->execute(array($id));
$result = $stmt->fetch(PDO::FETCH_ASSOC);
if ($result == 'Reminder1') {
echo 'Update Your Pasword reset reminder page';
} else {
header('Location: /home.php');
}
?>
Also see:
control
structures
if control structure
header() function

fetch data
mysql_connect("localhost", "user", "pass") or die(mysql_error());
mysql_select_db("database") or die(mysql_error());
$data = mysql_query("SELECT reminder FROM users WHERE id='".$id."' LIMIT 1") or die(mysql_error());
$row = mysql_fetch_assoc($data);
if($row['reminder'] == 'Reminder1') {
header("Location: /reset_password.php");
}
else {
header("Location: /home.php");
}
// but you should use PDO
$dbh = new PDO('mysql:host=localhost;dbname=database', 'user', 'pass');
$sth = $dbh->prepare("SELECT reminder FROM users WHERE id=:id LIMIT 1");
$sth->execute(array(':id' => $id));
$sth->setAttribute(PDO::FETCH_ASSOC);
$row = $sth->fetch();
if($row['reminder'] == 'Reminder1') {
header("Location: /reset_password.php");
}
else {
header("Location: /home.php");
}

Related

Login not checking if password is wrong

So for some reason if the password is correct it knows and takes the user to the correct user account, but if the pass is wrong, it wont log them in but still takes them to the account page that isn't logged in.
Can someone please help me out to not re-direct them if the password is wrong
<?php
session_start();
//$connection = mysqli_connect('localhost', 'root', '');
$connection = mysqli_connect("pdb18.awardspace.net","*****","******","*****");
if (!$connection){
die("Database Connection Failed" . mysqli_error($connection));
}
$select_db = mysqli_select_db($connection, '******');
if (!$select_db)
{
die("Database Selection Failed" . mysqli_error($connection));
}
$username=trim($_POST['username']);
$password=trim($_POST['password']);
//$encoded_password = base64_encode($password);
$sql = "SELECT * from register where Username='".$username."' and Password='".$password."'";
$result = mysqli_query($connection, $sql) or die(mysqli_error($connection));
$result = $con->query($sql);
$count = mysqli_num_rows($result);
//echo $count;
if ($count == 1){
while($row = $result->fetch_assoc()) {
$id=$row['id'];
}
$_SESSION['User'] = $username;
$_SESSION['UserId'] = $id;
echo "valid";
}
else{
echo "Invalid";
}
?>
Remove this line:
$result = $con->query($sql);
You are using procedural functions, mysqli_*.
This part of code $con->query is OOP style, which you are not using in your code, and overwritting the value o $result variable.
You can use both styles, but you should use the same connection, or $connection in your case.

Undefined index: userID error

Upon Logging in, I have the userID stored in the SESSION. However when I call updateMarkerlocations.php it says userID is undefined. Not sure what I'm missing.
login.php
session_start();
if (!isset($_POST['submit'])){
} else {
require_once("db_const.php");
$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
# check connection
if ($mysqli->connect_errno) {
echo "<p>MySQL error no {$mysqli->connect_errno} : {$mysqli->connect_error}</p>";
exit();
}
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * from userinfo WHERE username LIKE '{$username}' AND password LIKE '{$password}' LIMIT 1";
$result = $mysqli->query($sql);
if (!$result->num_rows == 1) {
echo "<p>Invalid username/password combination</p>";
} else {
$row = $result->fetch_assoc();
setcookie("username", time() +60*60*24*30*365);
$_SESSION['userID'] = $row['userID'];
echo "<p>Logged in successfully!, Please close the window</p>";
}
}
?>
updateMarkerLocations.php
<?php
include 'db_const.php';
function insertMarkerLocations()
{
$markerCount = 0;
if (isset($_POST['markerCount']))
$markerCount = $_POST['markerCount'];
if(isset($_SESSION["userID"]))
{
$userID = $_SESSION["userID"];
}
$con = mysql_connect(DB_HOST, DB_USER, DB_PASS);
mysql_select_db(DB_NAME);
$userID = $_POST['userID'];
for($i=0 ; $i < $markerCount; $i++){
$index = $i;
++$index;
$curMarkerID = $_POST["markerID$index"];
$curLang = $_POST["lang$index"];
$curLat = $_POST["lat$index"];
// Now write the current marker details in to the db.
$query = "INSERT INTO userinfo (userID, markerID, lang, lat ) VALUES ('$userID', '$curMarkerID', '$curLang', '$curLat')";
mysql_query($query)
or die(mysql_error());
}
$msg = "SUCCESS";
return $msg;
}
$msg = insertMarkerLocations();
echo json_encode($msg);
?>
Add this at the top of each file:
if(!isset($_SESSION)) session_start();
Also, when you do:
$userID = $_POST['userID'];
you should ensure that $_POST['userID'] exists:
if(isset($_POST['userID'])) $userID = $_POST['userID'];

Fetch data from a row from mysql database

I need to display a reply data on my page from my 'feedback' field in my mysql table. I want each user to have a different 'feedback' response stored per row and fetched when the user logs into a page through a session. I have set up my database but find it difficult forming the php code to view the feedback on my page...please can someone help../
<?php
session_start();
if ($_SESSION['username'])
{
$con = mysqli_connect('localhost','root','');
if (!$con)
{
die('Could not connect: ' . mysqli_error($con));
}
mysqli_select_db($con,"loginsession");
$username = $_SESSION['username'];
$sql="SELECT * FROM users WHERE username = $username";
$result = mysqli_query($con,$sql);
$feedback = mysql_query("SELECT feedback FROM users WHERE username='$username'");
echo $feedback;
}
else
header("Location: index.php");
?>
$feedback in this case is not a string, its a mysql resource. You need to fetch each row individually with something like:
echo "<PRE>";
while ($row = mysql_fetch_assoc($feedback)) {
print_r($row);
}
Also you should put $username through mysql_real_escape_string() or else your code may be vulnerable to SQL injection attacks.
Edit: (Disclaimer) The method you are using and my suggestion are very outdated and have been depreciated in php5.5 I suggest you look into prepared statements.
$sql = mysql_query("SELECT feedback FROM users WHERE username='{$username}' LIMIT 1");
$feedback = mysql_fetch_assoc($sql);
echo $feedback[0];
<?php
session_start();
if ($_SESSION['username'])
{
$con = mysqli_connect('localhost','root','');
if (!$con)
{
die('Could not connect: ' . mysqli_error($con));
}
mysqli_select_db($con,"loginsession");
$username = $_SESSION['username'];
$sql='SELECT feedback FROM users WHERE username = "'.$username.'"';
$result = mysqli_query($con,$sql);
while($row = mysqli_fetch_array($result))
{
echo $row['feedback'];
}
}
else
header("location: index.php");
?>

PHP mysql_real_escape_string(); whats the correct method using mysqli?

its a little difficult to explain. I've build the mysql function which works fine and with the depreciation of mysql I will need to change this function to use mysqli rather than the mysql method.
I current have:
$con = mysql_connect("host", "username", "pass");
mysql_select_db("db", $con);
$Username = mysql_real_escape_string($_POST['user']);
$Password = hash_hmac('sha512', $_POST['pass'], '&R4nD0m^');
$Query = mysql_query("SELECT COUNT(*) FROM users WHERE username = '{$Username}' AND password = '{$Password}'") or die(mysql_error());
$Query_Res = mysql_fetch_array($Query, MYSQL_NUM);
if($Query_Res[0] === '1')
{
//add session
header('Location: newpage.php');
}
else {
echo 'failed login';
}
Now I've applied mysqli to this and it's not returning any data or errors but the function still complies.
$log = new mysqli("host", "user", "pass");
$log->select_db("db");
$Username = $log->real_escape_string($_POST['user']);
$Password = hash_hmac('sha512', $_POST['pass'], '&R4nD0m^');
$qu = $log->query("SELECT COUNT(*) FROM users WHERE username = '{$Username}' AND password = '{$Password}'");
$res = $qu->fetch_array();
if($res[0] === '1'){
//add session
header('Location: newpage.php');
}
else {
$Error = 'Failed login';
sleep(0.5);
}
echo $res['username'].' hello';
}
But I'm unsure on why this is wrong. I know it's probably a simply answer
Just to have it as an answer:
http://php.net/manual/en/pdo.prepared-statements.php
http://php.net/manual/en/pdo.prepare.php
e.g.
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name, value) VALUES (:name, :value)");
$stmt->bindParam(':name', $name);
$stmt->bindParam(':value', $value);
You may check if the connection is establishing before using real_escape_string()
if ($log->connect_errno) {
echo "Failed to connect to MySQL: (".$log->connect_errno.")".$log->connect_error;
}
afaik, there's no problem with $log->real_escape_string($_POST['user']);

Syntax error in MySQL statement

EDIT: I know the error is somewhere here:
$connection = #mysql_connect($server, $dbusername, $dbpassword) or die(mysql_error());
$db = #mysql_select_db($db_name,$connection) or die(mysql_error());
$sql = "SELECT * FROM authorize WHERE username = '$_SESSION[user_name]' and password = '$_SESSION[password]'";
$result = #mysql_query($sql, $connection) or die(mysql_error());
$num = mysql_num_rows($result);
$lstbalance = 0;
$balance = 0;
//set session variables if there is a match
if ($num != 0)
{
while ($sql = mysql_fetch_object($result))
{
$lstbalance = $sql -> lostbalance;
$balance = $sql -> balance;
}
}
if ($win==true)
{
$sql = "update users set lostbalance='($lstbalance+(($payouts[$result1.\'|\'.$result2.\'|\'.$result3])*(int)$_POST[\'bet\']))' WHERE username = '$_SESSION[user_name]' and password = '$_SESSION[password]'";
}
else
{
$sql = "update users set lostbalance='(lstbalance-(int)$_POST[\'bet\'])' WHERE username = '$_SESSION[user_name]' and password = '$_SESSION[password]'";
}
$result = #mysql_query($sql, $connection) or die(mysql_error());
I was able to narrow down the error to this piece of code, help appreciated. Regards.
When I comment it out everything seems to work all the connect variables are from a different file and are valid.
$lostbalance = $lstbalance+(($payouts[$result1])*(int)$_POST['bet']));
$sql = "update users set lostbalance='$lostbalance' WHERE username = '".$_SESSION['user_name']."' and password = '".$_SESSION['password']."'";
i dont understand about ur code on $payout[$result1.\'|\'.$result2.\'|\'.$result3]

Categories