No Match found using query in MySql database using PHP -
i have mysql database following columns:

and html form so:
<form method="post" action="validate.php"> <label for="users_email">email:</label> <input type="text" id="users_email" name="users_email"> <label for="users_pass">password:</label> <input type="password" id="users_pass" name="users_pass"> <input type="submit" value="submit"/> </form> here's snippet of code within validate.php page:
$email = $_post['users_email']; $pass = $_post['users_pass']; $dbhost = '************'; $dbuser = '************'; $dbpass = '************'; $conn = mysql_connect($dbhost, $dbuser, $dbpass); if(! $conn) { die('could not connect: '. mysql_error()); } mysql_select_db("safedropbox", $conn); $result = mysql_query("select email, userpassword tblnewusers email = $email"); $row = mysql_fetch_array($result); if($row['email'] == $email && $row['userpassword'] == $pass) { echo "valid"; } elseif($row.count() == 0) { echo "no match"; } else { echo "invalid"; //header("location: http://www.google.ie"); //exit(); } the problem i'm getting no match though values of $email , $pass within database. doing wrong?
the problem in:
$result = mysql_query("select email, userpassword tblnewusers email = $email"); $email should escaped , surrounded quotes. safest solution use prepared statement:
$result = mysql_query("select email, userpassword tblnewusers email = ?"); $con=new mysqli($dbhost, $dbuser, $dbpass, $yourdatabase); $stmt = $mysqli->prepare($result); $stmt->bind("s",$email); $result=$stmt->execute(); for more details see http://php.net/manual/en/mysqli.quickstart.prepared-statements.php
Comments
Post a Comment