0

OK this is my first time asking a question on this site, but here i go. So im learning how to create logins and such. I was watching a video and he did a line of code and for some reason im doing the same thing and it is not working. If anyone could help that would be amazing.

Code:

<?php
 if ($_POST['loginbtn']){
          $user = $_POST['user'];
          $password = $_POST['password'];

          if($user){
             if($password){

                require("../testing/dbconfig.php");

                //encrypt password
                $password = md5(md5("a4v".$password."weed"));
                //verify user is real
                $query = mysql_query("SELECT * FROM user WHERE username='$user'");
                $numrows = mysql_num_rows($query);
                if($numrows == 1){

                   $row = mysql_fetch_assoc($query);

                   $dbid = $row['id'];
                   $dbuser = $row['username'];
                   $dbpass = $row['password'];
                   $dbactive = $row['active'];

                   if ($password == $dbpass){
                       if($dbactive == 1){

                          //allowing users session
                          $_SESSION['userid'] = $dbid;
                          $_SESSION['username'] = $dbuser;


                          echo "Logged in as <b>$dbuser</b>. Please wait while you are redirected.";
                       }
                       else
                          echo "This account has not been activated. Please contact admin if you think this is a problem.";
                   }
                   else
                      echo "The password that was entered was invalid. Please check spelling.";
                }
                else
                    echo "Username was not valid. Please check spelling and try again";

                mysql_close();
          }
          else
               echo "<center style='font-size:32px; color:red;'>You must have a set Password/center>";
          }
          else
               echo "<center style='font-size:32px; color:red;'>You must have a set Username</center>";
      }
      else
           echo "<center style='font-size:32px; color:red;'>Waiting for login requests....</center>";

?>

Now the error is shooting out here

$numrows = mysql_num_rows($query);
                if($numrows == 1){

                   $row = mysql_fetch_assoc($query);

                   $dbid = $row['id'];
                   $dbuser = $row['username'];
                   $dbpass = $row['password'];
                   $dbactive = $row['active'];

Error on recieving end

Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /srv/disk10/1954442/www/satan.cf/testing/login.php on line 56 Username was not valid. Please check spelling and try again
  • 3
    You should use a more modern tutorial, the `mysql_*` functions have been deprecated in older and completely removed from the newest php versions. And the password hashing is also not quite up-to-date. – jeroen Oct 20 '16 at 15:03
  • I'm Agree with @jeroen you just started learning, so use PDO, it's much easier and more secure if you use it correctly ! – Sinf Oct 20 '16 at 15:04
  • That video is obviously CRAP. The code is vulnerable to [sql injection attacks](http://bobby-tables.com), it simply ASSUMES success unconditionally, and md5 is utterly USELESS for password storage. You also forgot `session_start()`, so the session-related code is pointles, blah blah blah. – Marc B Oct 20 '16 at 15:05
  • oh thanks for all the responses i will get ride of everything and get more updated sources – Young Coder Oct 20 '16 at 16:09

0 Answers0