-1

Somebody can login. If he login, the entered password (decoded) will be compared with the right passwort (also decoded) But if I make 

$sql = "SELECT PasswordDecode FROM Userinformations WHERE Username = ".$Username;
    foreach ($pdo->query($sql) as $row) {
        $PasswordDecode = $row["Password decode"];
    }

this error comes:

Warning: Invalid argument supplied for foreach() in ...

I don't understand. If the username is DumbUsername and I make 

$sql = "SELECT PasswordDecode FROM Userinformations WHERE Username = DumbUsername";

No error happend and it works. But if I write the Username in a variable, it dowsn't work. Why?
Please answer.

chris85
  • 23,846
  • 7
  • 34
  • 51
Korne127
  • 168
  • 14
  • `SELECT PasswordDecode FROM Userinformations WHERE Username = DumbUsername` is invalid SQL, strings need to be quoted. This also opens you to SQL injections, use parameterized queries, this will take care of the quoting as well. – chris85 Jun 12 '16 at 17:12

1 Answers1

0

Change your query, use quotes arround variable

  $sql = "SELECT PasswordDecode FROM Userinformations WHERE Username = '$Username'";
Niklesh Raut
  • 34,013
  • 16
  • 75
  • 109