-5

I'm trying to create a login system but for some reason there is a error in my code and I can't seem to figure out what it is.

    <?php
include "connect.php";
?>

<body>
<?php
if(isset($_POST['submit'])){
$username = $_POST['email'];
$password = $_POST['password'];

$result = mysql_query($con,"SELECT * FROM users WHERE username=$username AND password=$password");
$num = mysql_num_rows($result);
if($num == 0){
echo "Bad login, go <a href='login.php'>back</a>.";
}else{
session_start();
$_SESSION['username'] = $username;
header("Location: index.php");
}
}
?>

    <div class="container">
      <form action='signin.php' method='POST' class="form-signin" >
        <h2 class="form-signin-heading">Please sign in</h2>
        <input type="text" class="input-block-level" placeholder="Email address" name="email">
        <input type="password" class="input-block-level" placeholder="Password" name="password">
        <label class="checkbox">
          <input type="checkbox" value="remember-me"> Remember me
        </label>
        <button class="btn btn-large btn-primary" type="submit" name="submit" value="Login">Sign in</button>
      </form>

These are the errors on submit:

Warning: mysql_query() expects parameter 1 to be string, object given in C:\xampp-portable\htdocs\bootstrap\signin.php on line 71

Warning: mysql_num_rows() expects parameter 1 to be resource, null given in C:\xampp-portable\htdocs\bootstrap\signin.php on line 72
Bad login, go back.
Noah R
  • 5,287
  • 21
  • 56
  • 75
  • At least ***describe*** the symptoms of the problem! Wild guess: http://stackoverflow.com/questions/8028957/headers-already-sent-by-php – deceze Mar 31 '13 at 10:36
  • When I sign in it fails. – Noah R Mar 31 '13 at 10:36
  • is your database connection ok ? – MrSimpleMind Mar 31 '13 at 10:37
  • You're also wide open to SQL injection and you're using a deprecated database API. – deceze Mar 31 '13 at 10:37
  • 2
    [**Please, don't use `mysql_*` functions in new code**](http://bit.ly/phpmsql). They are no longer maintained [and are officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). See the [**red box**](http://j.mp/Te9zIL)? Learn about [*prepared statements*](http://j.mp/T9hLWi) instead, and use [PDO](http://php.net/pdo) or [MySQLi](http://php.net/mysqli) - [this article](http://j.mp/QEx8IB) will help you decide which. If you choose PDO, [here is a good tutorial](http://j.mp/PoWehJ). – tereško Mar 31 '13 at 10:38

1 Answers1

2

1) You confuse mysql & mysqli query. It is 

$result = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");
and
$result = mysqli_query($con,"SELECT * FROM users WHERE username='$username' AND password='$password'");

2) This code is very dangerous of sql injection. You need to sanitize it before use it formally. 3) 

for the success case, set a session id sth like that: $session_id = session_id(); 
reverse that:
$username=$_SESSION["username"]; 
and use both variables in redirection:
header ("Location: index.php?username=$username&session_id=$session_id");
Nik Drosakis
  • 2,258
  • 21
  • 30