-6
      $result=mysql_query("SELECT * FROM superhidden WHERE username = '$username' AND  password='$password'");



      $credentials = mysql_num_rows($result);

      echo $credentials;

This echoes 0!!! When $username = admin and $password = admin... and the supperhidden table contains a row admin | admin

user2712167
  • 1
  • 1
  • 1

1 Answers1

1

First thing I'd check is for leading or trailing spaces in both the table columns and the $username/$password variables.

You can examine leading or trailing spaces in the DB with something like:

select    *
  from    superhidden
 where    username like ' %'
    or    username like '% '
    or    password like ' %'
    or    password like '% '

You can use var_dump for examining the variables.

And, of course, the near-obligatory remarks on almost all PHP/MySQL questions:

  • The mysql_* functions are deprecated, you should be using one of the newer APIs.
  • Use of user input without sanitisation is a bad idea. You should make sure both $username and $password cannot be used for SQL injection attacks. Search for parameterised queries or SQL injection for more detail.

It's also generally a bad idea to store passwords in plain text, as evidenced by the rather large number of data "thefts", the latest of which was Target in the USA with some 70 million customers affected. There's a good QA here which provides some guidance.

Community
  • 1
  • 1
paxdiablo
  • 854,327
  • 234
  • 1,573
  • 1,953
  • More a comment than an answer? – Niels Keurentjes Jan 22 '14 at 01:41
  • 1
    @NielsKeurentjes, no, I'm positing that as an answer. If it turns out to be wrong, I'll delete it. Comments are meant for clarifications and tangential stuff, like arguing about deprecated features and SQL injection :-) – paxdiablo Jan 22 '14 at 01:43
  • 1
    +1'd. Last thing: as soon as you added the obligatory remarks section - a link to http://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords or something similar might be helpful – zerkms Jan 22 '14 at 01:56
  • It turned out I used $username = "something else" up further on the page which made it read the wrong username from the table.. – user2712167 Jan 22 '14 at 02:09