Hi everyone,

I have created a login page where the user fills in the username and password and logins in the website. When i validate the username and password in gives me the following error:

Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in /home/public_html/Xenia/confirmuserlogin.php on line 17

The code that i have written is the following:

PHP Code:


<?  

    $query = "SELECT * FROM Customers WHERE username='$username'";
    $result = mysql_query($query);
    $row = mysql_fetch_array($result); //Here is the line 17
    
    echo $row['username'];
    echo $row['password'];
    echo $result;
   
    if($pass!=$row['password']){
     echo "<h3>Your password is not correct. Please log on again!</h3>";
     include("userlogin.php");
    }else{
       
        
     $_SESSION['username']=$username;
      
    
     
     include("index.php");
    
    
    }


?>

Could you please suggest anything?

Thank you,
Xenia

There is an error in your sql code, so a bad result set is being returned.

Try outputting $query and feed it directly to the database, looking where the problem is.

Your approach to logging in is abit different, I would suggest creating a query which checks for both username and password, rather than going through the process of checking the row for the right password.

eg:

SELECT * FROM Customers WHERE username='$username' AND password='$password';

And then use:

PHP Code:

if(mysql_num_rows($result) == 1)
  // authorized user 


If you havent already, also look into making the password field md5/sha1 encoded in the database and checking it against an md5/sha1 password.

So when the customer creates an account insert the password into the account encoded.

PHP Code:

$password = sha1($_POST['password']); 


And when they login:

PHP Code:

$password = sha1($_POST['password']);
$query = "SELECT * FROM Customers WHERE username='$username' and password='$password';"; 


Also remember to check all input supplied by users is safe to parse to the database using addslashes/mysql_real_escape_string/htmlentities. If you dont a simple bit of code can enable a user to gain access without a password.

Thank you very much for your suggestion, i change the password to encoded.
However the problem still exist.
I output the query and gives me the correct details,when i try to output the result
it doens't s display anything.Even if i change to mysql_num_rows it gives me the same error.

What else you think might cause that problem?

Youn Can use mysql_fetch_assoc () instead of mysql_fetch_array()

Originally Posted by xenia

Thank you very much for your suggestion, i change the password to encoded.
However the problem still exist.
I output the query and gives me the correct details,when i try to output the result
it doens't s display anything.Even if i change to mysql_num_rows it gives me the same error.

What else you think might cause that problem?

Have you tried feeding the output from the query to the database and seeing what the database says? Copy and paste the output into phpmyadmin.

Actually i found what was the problem,very silly but in programming this happens,i had forgot to include the file that connects with the database.
Now another problem is with the encoded password.I put in the page where the user insert the details the variable that keeps the password :

$pass=sha1($_POST['password']);

and the insert statement

$query="Insert into Customers (`title`,`username`, `password`, `firstname`, `lastname`, `address`, `town`, `county`, `postcode`, `email`)
values ('$title','$username','$pass','$forename','$surnam e','$fulladdress','$town','$county','$postcode','$ email')";
$rs=mysql_query($query);

but it doesn't put it encoded in the database.Only if i go manually from the phpAdmin i change the text type to sha1 and is changing.But i want to be inserted in the database encoded.

Any ideas?

Thank you,
Xenia

I didn't change anything but now is working, what can i say computers .
Thank you all for your help