Logging In via AJAX/MySql/PHP

Question

Basically I want to check a database to see if the username and password are a match if so unlock the submit button.

<?php
mysql_connect('localhost', '', '');
mysql_select_db('database');
if(isset($_POST['submit'])){
    mysql_query("SELECT username,password FROM table WHERE username='".$_POST['username']."',password='".$_POST['password']."'")
}
?>

Form:

<form method="post">
Username <input type="text" name="username" />
Password <input type="password" name="password" />
<input type="submit" name="submit" value="Login" />
</form>

why do you need to unlock submit button, then there is no use of submit button in your login form. — Muthu Kumaran
– Muthu Kumaran, Commented Apr 9, 2011 at 17:45

John · Accepted Answer · 2011-04-09 18:10:03Z

2

I don't know if i get you right but anyway try :

HTML:

  <form method="post">
     Username <input type="text" id="username" name="username" />
     Password <input type="password" id="password" name="password" />
    <input type="submit" name="submit" id="submit" value="Login" />
 </form>

jQuery:

    $("#submit").hide();
    $.post("checkUsername.php", { username: $("#username").val(), password: $("#password").val() }, function(result) {
 if(result == "true") { $("#submit").fadeIn(fast); }

 });

Php ( checkUsername.php ):

if(mysql_num_rows(mysql_query("SELECT username,password FROM table WHERE username LIKE '". mysql_real_escape_string($_POST['username']) . "',password LIKE '".mysql_real_escape_string($_POST['password'])."'")))
    {
       echo "true";
    }
    else
    {

    echo "false";
    }

answered Apr 9, 2011 at 18:10

John

7,94017 gold badges67 silver badges96 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Frank Farmer · Accepted Answer · 2011-04-09 17:49:03Z

2

What's your question? You forgot to actually ask one ;)
You need to, at a minimum, escape strings with mysql_real_escape_string() before inserting them into a query. Otherwise you're ripe for SQL injection
Saving passwords in plain text is generally inadvisable. Hash and salt.
There are already auth libraries out there that do most of this for you, and protect you against a whole host of other issues you've not yet heard of. Don't reinvent a wheel that's been built many times before by much more experienced people. Evaluate packages like PEAR_Auth

answered Apr 9, 2011 at 17:49

Frank Farmer

39.6k12 gold badges73 silver badges90 bronze badges

Comments

Daniel Crowley · Accepted Answer · 2013-03-21 22:49:27Z

0

You should avoid using the LIKE keyword for a login prompt like this, since wildcards are unaffected by mysql_real_escape_string. A user can log in with a username and password of "%".

See the following blog post: http://blog.spiderlabs.com/2012/03/like-omg.html

Use = instead of LIKE.

answered Mar 21, 2013 at 22:49

Daniel Crowley

1

Collectives™ on Stack Overflow

Logging In via AJAX/MySql/PHP

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related