How do I get MySQL query to allow the php $_POST?

Question

$myResult = mysqli_query($con, "SELECT * FROM users WHERE Password=$_POST=['password']");

It won't let me put my $_POST. I need to have it adaptable so it won't be set to just one password.

Here's the rest of my code, this is a localhost learning thing, so I'm not giving anything away

<?php
$con=mysqli_connect('localhost','root','Llamabash','whales');
if (mysqli_connect_errno()) {
    echo'Database connection error: ' . mysqli_connect_error();
    echo'<br>';
} else {
    echo'Connected to database';
    echo'<br>';
}
//works fine up till here
$myResult = mysqli_query($con, "SELECT * FROM users WHERE Password");
$checkUsername = $_POST['username'];
$checkPassword = $_POST['password'];
while($check = mysqli_fetch_array($myResult,MYSQLI_ASSOC)) {
    //echo $check;
    //echo '<br>';
    if($checkUsername == $check['Username'] && $checkPassword == $check['Password']) {
        echo'<h1>Logged in.</h1>';
        echo'<h1>Hello ' . $check['Username'] . '!</h1>';
    } elseif ($checkUsername == NULL) {
        echo'<p>Please Enter Username.</p>';
    } elseif ($checkPassword == NULL) {
        echo'<p>Please Enter Password.</p>';
    } elseif ($checkPassword != $check['Password'] or $checkUsername != $check['Username']) {
        echo'<p>The Username or Password is incorrect.</p>';
    } else {
        echo 'something weird is happening';  
        echo '<br>';
    }
}

mysqli_close($con);
echo'Exited database.';
?>

You need to learn about 1) string concatenation and 2) prepared statements. — Mr. Llama, Jun 11 '14 at 14:35
*"WHERE Password=$_POST=['password(it won't let me do this)']""* - Of course it won't, and all the better too. — Funk Forty Niner, Jun 11 '14 at 14:35
Right now you are adding all of your $_POST statements as string literals consisting of '$_POST['mything']'. What you need to do is break the string every time you want to add a post element, concatenate the element, and then concatenate a continuation of your string. — PugsOverDrugs, Jun 11 '14 at 14:41
`$_POST['password']` and `$_POST=['password']` are two TOTALLY different things. e.g. you need to learn basic PHP syntax rules. — Marc B, Jun 11 '14 at 14:43

How do I get MySQL query to allow the php $_POST?

0 Answers0