User Authentation using php and mysql - php

Question

guys i am working on android 2.2 i am stuck where the user need to be authenticated with his use name and password
below is my code
PHP code:
<?php
$un=$_POST['userid'];
$pw=$_POST['password'];
mysql_connect("localhost","root","");
mysql_select_db("myhealthcare");
$sql=mysql_query("select userid,password from register where userid='$un' and password='$pw'");
while($row=mysql_fetch_assoc($sql))
$output[]=$row;
print(json_encode($output));
mysql_close();
?>
Java Code:
ArrayList<NameValuePair> nvp = new ArrayList<NameValuePair>();
nvp.add(new BasicNameValuePair("userid", userid.getText().toString()));
nvp.add(new BasicNameValuePair("password", password.getText().toString()));
String un = userid.getText().toString();
String pass = password.getText().toString();
System.out.println("user name is " + un);
System.out.println("password is " +pass);
// Log.e(""+sid.getText().toString(),"0");
// Log.e(""+sname.getText().toString(),"0");
try {
HttpClient httpclient = new DefaultHttpClient();
HttpPost httppost = new HttpPost("http://10.0.2.2/login.php");
httppost.setEntity(new UrlEncodedFormEntity(nvp));
HttpResponse response = httpclient.execute(httppost);
HttpEntity entity = response.getEntity();
is = entity.getContent();
} catch(Exception e){
Log.e("log_tag", "Error in http connection"+e.toString());
}
try {
BufferedReader bf = new BufferedReader(new InputStreamReader(is,"iso-8859-1"),8);
sb = new StringBuilder();
sb.append(bf.readLine()+ "\n");
String line="0";
while ((line = bf.readLine()) != null) {
sb.append(line + "\n");
}
is.close();
result=sb.toString();
System.out.println("value of result " +result);
}catch(Exception e){
Log.e("log_tag", "Error converting result "+e.toString());
}
String unm,pwd;
try {
jArray = new JSONArray(result);
JSONObject json_data = null;
for(int i=0;i<jArray.length();i++){
json_data = jArray.getJSONObject(i);
unm = json_data.getString("userid");
pwd = json_data.getString("password");
System.out.println("databse user name is " +unm);
System.out.println("databse password is " +pwd);
}
} catch(JSONException e1){
Toast.makeText(getBaseContext(), "No details Found" ,Toast.LENGTH_LONG).show();
} catch (ParseException e1) {
e1.printStackTrace();
}
i am able to fetch the value from database but i am not able to compare with user entered values please help

Answer 1

I would do the PHP sometheing like this instead, to do the authentication on the server and not passing the login info back and forth:
<?php
$un=mysql_real_escape_string($_POST['userid']);
$pw=mysql_real_escape_string($_POST['password']);
mysql_connect("localhost","root","");
mysql_select_db("myhealthcare");
$result=mysql_query("select userid from register where userid='$un' and password='$pw'");
if (mysql_num_rows($result) == 0) {
print("Not authorized"); // Or send a json-encoded object containing the message
} else {
print("Authorized");
}
mysql_close();
?>
Update
Use PHP's mysql_real_escape_string() before running any data input by a user in your SQL. Otherwise you open your DB to SQL-injections, which is really bad.