PHP/MYSQL - checking user identification from DB info

Question

So, i am making kind of a blog system for my site, and i have 2 tables. One for storing users, their passwords and images (URLs), another for storing all the blog posts, with image_url, author, date and content. The relevant part of my HTML is:

<form action="../scripts/send.php" method="post"><input type="text" name="author" placeholder="Your name" style="width:30%;"/><input type="password" name="pass" placeholder="Password" style="width:30%;"/><br /><input type="text" name="title" placeholder="Post Title" style="width:60%;" /><br /><textarea name="content" rows="20" style="width:60%;"></textarea><br /><button >Post</button></form>

And my PHP code (send.php) is:

<?php
mysql_connect("localhost","kroltan","eclipsepdt123") or die("Can't connect to DB");
mysql_select_db("kroltan_main") or die("Can't select to DB");
$result = mysql_query("SELECT * FROM `users`") or die("Can't fetch data");
if(mysql_num_rows($result) > 0){
    while($row = mysql_fetch_assoc($result)){
        if ($row['name'] == strtolower($_POST['author'])){
            if ($row['pass'] == strtolower($_POST['pass'])){
                $name = $_POST['name'];
                $comm = $_POST['comment'];
                $result = mysql_query("INSERT INTO blog_posts (img_url, author, title, content) VALUES(".$row['img'].", ".$_POST['author'].", ".$_POST['title'].", ".$_POST['content'].")") or die("Can't send data");
                header("Location: /?/=Talk");
            }
        }
    }
}
?>

When i try to create a new post on the site, it does not work. I am not even redirected to the page

It appears you've posted your MySQL username and password in public. If that is your actual password, then (a) you should use better passwords; (b) you should change the password immediately. Just editing the post to remove it will not help; people have already seen it, and further it'll remain in the revision history. — derobert
– derobert, Commented Feb 2, 2012 at 18:13

Crashspeeder · Accepted Answer · 2012-02-02 16:47:38Z

1

You don't have a submit button. This is an HTML question, not a PHP/MySQL question.

<input type="submit" value="Post" />

answered Feb 2, 2012 at 16:47

Crashspeeder

4,3112 gold badges18 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Kroltan Over a year ago

Sorry, i beleived tat there was something wrong with my PHP code.

Vyktor · Accepted Answer · 2012-02-02 16:51:52Z

I'm sorry, but that's terrible usage of mysql :)

At first, let's start with fixing your query:

$error = '';
if( isset( $_POST['user']) && isset( $_POST['pass'])){
    $user = mysql_real_escape_string( $_POST['user']);
    $pass = mysql_real_escape_string( $_POST['pass']);

    $q = mysql_query( "SELECT * FROM users WHERE user = '$user' AND pass '$pass'");
    if( !$q){
       $error = 'Query error: ' . mysql_error();
    } else {
        if( mysql_num_rows( $q)){
             // Redirect
        } else {
             $error = 'Wrong user name or password';
        }
    }
} else {
    $error = 'Missing post data.';
}
die( 'Error: ' . $error . "\n");

And MattyB provided great answer about how to fix your form.

MattyB · Accepted Answer · 2012-02-02 16:46:23Z

0

You don't want a button, you want an input of type submit:

<INPUT TYPE=submit VALUE="Post"/>

http://htmlhelp.com/reference/html40/forms/input.html

answered Feb 2, 2012 at 16:46

MattyB

9522 gold badges9 silver badges16 bronze badges

Collectives™ on Stack Overflow

PHP/MYSQL - checking user identification from DB info

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related