User login form and cookie

Hi,

i have a form with 2 fields (username, userpassword). Once the user click submit, the username and password should be verified on my database and then a cookie assigned. However, $value is always = 0 when the script runs.

Here is the code...

function login() {
global $dbhost, $dbname, $dbusername, $dbpassword, $admin_table, $username, $userpassword;
db_connect();
print ("<p>$username, $userpassword, $admin_table</p>n");
$SQL = "SELECT * FROM $admin_table WHERE user_id ='$username'";
$query = mysql_query($SQL);
$row = mysql_fetch_array($query);
if (($row["user_id"] == $username)
AND ($row["password"] == $userpassword)
AND ($username != "")){
$user_id = $row["user_id"];
$md5pw = md5($userpassword);
SetCookie("TheLoginCookie", "$user_id:$md5pw", time()+3600);
$value = 1;
else {
$value = 0;
f }
return $value;
}

Can anyone help?

Well, the first place to start is your if statement. if the $value never goes to 1 then your if is not evaluating as true....

if (($row["user_id"] == $username)
AND ($row["password"] == $userpassword)
AND ($username != "")){

Are you storing the password encrypted in the database? If so, you need to encrypt the $userpassword variable before comparing it... Something to try anyway...

You have the $username variable in single quotes. Variables don't interpret in single quotes - literal strings only.

Thanks for your suggestions, but unfortunately I still get the same result!

Any other ideas?

Try this and see if the results are what you expect....

function login() {
global $dbhost, $dbname, $dbusername, $dbpassword, $admin_table, $username, $userpassword;
db_connect();
print ("<p>$username, $userpassword, $admin_table</p>n");
$SQL = "SELECT * FROM $admin_table WHERE user_id ='$username'";
echo "Query used: $SQL<BR>n";
$query = mysql_query($SQL);
$num_rows = mysql_num_rows($query);
echo "Num of rows returned: $num_rows<BR>n";
$row = mysql_fetch_array($query);
echo "variable username contains: $username<BR>n";
echo "database user_id contains: ".$row["user_id"]."<BR>n";
echo "variable userpassword contains: $userpassword<BR>n";
echo "database password contains: ".$row["password"]."<BR>n";
if (($row["user_id"] == $username)
AND ($row["password"] == $userpassword)
AND ($username != "")){
$user_id = $row["user_id"];
echo "Script is in the if statement. value should be set to 1.<BR>n";
$md5pw = md5($userpassword);
SetCookie("TheLoginCookie", "$user_id:$md5pw", time()+3600);
$value = 1;
else {
echo "Script is in the else statement. value should be set to 0.<BR>n";
$value = 0;
f }
return $value;
}