PHP MySQL Column invalid

Question

I have been trying for the past four days to get this working. It's just a simple logon page, where no sensitive information is stored, but I'm having problems with the PHP.

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $uname = $_POST["login"];
    $pword = $_POST["pass"];
    $uname = htmlspecialchars($uname);
    $pword = htmlspecialchars($pword);
    $user_name = "bradf294_access";
    $password = "********";
    $database = "bradf294_clients";
    $server = "localhost";
    $db_handle = mysql_connect($server, $user_name, $password);
    $db_found = mysql_select_db($database, $db_handle);
    print(mysql_errno());
    print($db_found);
    if(isset($db_found)){
        print($db_found."Success");
        $SQL = "SELECT * FROM basicinfo WHERE ref = $uname AND pass = $pword";
        $result = mysql_query($SQL);
        print("Query made");
        print(mysql_errno());
        if ($result) {
            print("result:".$result);
        }
        else {
            print("Incorrect Login Details");
        }
        if ($result > 0) {
            print("found user");
            $errorMessage= "logged on ";
            session_start();
            $_SESSION['login'] = "1";
            header ("Location: progressuser.php");
        }
        else {
            print("Invalid Logon");
        }
    } else {
        print("Database not found. The Webmaster has been notified. Please try again   later");
        $subject = "Automated login error" ;
        $message = "An error occured whilst trying to connect to the MySQL database, to login to the progress checker" ;
        mail("[email protected]", $subject, $message);
    }

From the output on the page which I've been using to debug, it appears to be the lines which don't seem to be working, which are giving a 1054 error - "Unknown column '%s' in '%s'"

$SQL = "SELECT * FROM basicinfo WHERE ref = $uname AND pass = $pword";
$result = mysql_query($SQL)

even though I copied and pasted the $SQL string into phpMyAdmin and it worked perfectly?

Is there anything blatantly obvious I'm doing wrong? Go to http://www.bradfieldandbentley.co.uk/test/progress.php and enter the details Reference: TST001 and pass: dnatbtr121 to see the output for yourselves.

Your PHP braces don't balance. It's important to make sure your code sample is syntactically correct. — the Tin Man
– the Tin Man, Commented Sep 18, 2012 at 23:15

andrewsi · Accepted Answer · 2012-09-18 18:29:00Z

1

You need to quote out the variables:

$SQL = "SELECT * FROM basicinfo WHERE ref = '$uname' AND pass = '$pword'";

HOWEVER

The mysql_* functions are being deprecated - you should look at moving to PDO or mysqli_* instead. Those both make it a lot easier for you to write secure code, as well as fixing the quoting problem for you.

answered Sep 18, 2012 at 18:29

andrewsi

10.7k132 gold badges37 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Adi Bradfield Over a year ago

Ahh something so simple! And thankyou, would you recommend any resources?

andrewsi Over a year ago

There's a lot of information on php.net - the PDO pages are at php.net/manual/en/intro.pdo.php and the mysqli quickstart guide is at php.net/manual/en/mysqli.quickstart.php

thatidiotguy · Accepted Answer · 2012-09-18 18:28:16Z

0

Should the value in your WHERE conditions not be surrounded by quotes, like in a normal MySQL statement? Yes. Also, you are going to get a bunch of comments about SQL injection.

answered Sep 18, 2012 at 18:28

thatidiotguy

9,01114 gold badges66 silver badges109 bronze badges

1 Comment

Adi Bradfield Over a year ago

Thankyou, and yes i realise that it isn't secure at all! I dont intend on storing any information of value on databases just yet!

Collectives™ on Stack Overflow

PHP MySQL Column invalid

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related