How can I check if username exists in database table.

[Dhiru1009]

Hi guys,

I need help with validating the user to see if the username exists in database table or not.

Here is my code.

default.php

 
<form name="form1" action="authenticate.php">
<table class="tableborder" align=center bgcolor="#f0f0f2">
    <tr>
  <td style="padding-bottom: 10px;" colspan="2" class="heading1"><b>Login Required</b></td>
</tr>
    <tr>
      <td height="30">Username:</td>
      <td><input type="text" name="Username" style="width:15em;">
      </td>
    </tr>
    <tr>
      <td height="30">Password:</td>
      <td><input type="password" name="Password" style="width:15em;">
      </td>
    </tr>
    <tr><td height="30" align="right"><input class="submit" name="register" type="button" value="Register" onClick="window.location=;"></td>
    <td><input name="submit" type="submit" value="Log-in" class="submit"></td></tr>
  </table>
</form>
 

authenticate.php

 
<?php
$con = mysql_connect("localhost","username","password");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
 
  }
mysql_select_db("tbl_login", $con);
$Username = $_POST['Username'];
$Password = $_POST['Password'] ; 
 
$sql="SELECT Username FROM login_tbl WHERE Username=’".$Username.”’ and Password=’”.$Password.”’”;
$r = mysql_query($sql);
if(!$r) {
   $err=mysql_error();
   print $err;
   exit();
}
if(mysql_affected_rows()==0){
   print "no such login in the system. please try again.";
   exit();
}
else{
   print "successfully logged into system.";
   //proceed to perform website’s functionality – e.g. present information to the user
}
?>

I desperately need to fix this code. Any help will be really appreciated.

Thanks

[Markus]

What's wrong with above code?
What does or doesnt happen?

Use mysql_num_rows() to see if the user name is already present.

[Dhiru1009]

What's wrong with above code?
What does or doesnt happen?

Use mysql_num_rows() to see if the user name is already present.

Hi markusn,

I am not sure what's wrong with the code. When I enter username and password which already exists in database and click on login I get a blank page. Please help me with this problem.

Thanks

[coolsti]

It is hard for us to see what the problem is. You need to do some debugging here yourself.

Suggestions: Echo out the query statement so you can see what is really being submitted to your database. See if there are any unexpected errors here, such as a blank value due to a typo or some other strange reason. Check to see that any non-alphabetic symbols in the password do not make the query incorrect syntactically.

Then if possible, try to copy and paste the query statement that you echo out to your screen directly into a database console window. This will let you see what the database is really outputting instead of having it filtered through your PHP code. Here you can see what the return is.

By the way, two things I notice about your code.

1) you have $Password used directly in your query, but don't you need to have something like a database specific function call like PASSWORD('$password')? My syntax here not totally correct but the point is, the database may store the password in an encrypted format so just comparing the stored value with the user supplied value directly may not work.

2) You examine if the user is registered by checking the affected rows, and this is not robust in my opinion. You should just use a SELECT count(*) statement and then examine the number of rows returned. If 0, then the user does not exist yet, if 1 then the user already exists.

[Atli]

Hi.

In your query, you are escaping the values in back-ticks (`) rather than single-quotes ('). That won't work.
Back-ticks are meant for column or database names. Single-quotes for string and date values.

Also, the structure of that code is a bit odd.
You should be making sure that the user is valid, or else show him an error. Your code does the except opposite, checking if the user is NOT valid, validating by default.

Consider the following:

$result = mysql_query("...") or die(mysql_error());
if(mysql_num_rows($result) == 1) {
  echo "Success! You are logged in!";
}
else {
  echo "Failure! Try again.";
}
 

Also note how I use the die() function there. Basically does the same thing the if statement after you query call does.

[Dhiru1009]

It is hard for us to see what the problem is. You need to do some debugging here yourself.

Suggestions: Echo out the query statement so you can see what is really being submitted to your database. See if there are any unexpected errors here, such as a blank value due to a typo or some other strange reason. Check to see that any non-alphabetic symbols in the password do not make the query incorrect syntactically.

Then if possible, try to copy and paste the query statement that you echo out to your screen directly into a database console window. This will let you see what the database is really outputting instead of having it filtered through your PHP code. Here you can see what the return is.

By the way, two things I notice about your code.

1) you have $Password used directly in your query, but don't you need to have something like a database specific function call like PASSWORD('$password')? My syntax here not totally correct but the point is, the database may store the password in an encrypted format so just comparing the stored value with the user supplied value directly may not work.

2) You examine if the user is registered by checking the affected rows, and this is not robust in my opinion. You should just use a SELECT count(*) statement and then examine the number of rows returned. If 0, then the user does not exist yet, if 1 then the user already exists.

Problem solved. Thanks guys.

[Dhiru1009]

Hi.

In your query, you are escaping the values in back-ticks (`) rather than single-quotes ('). That won't work.
Back-ticks are meant for column or database names. Single-quotes for string and date values.

Also, the structure of that code is a bit odd.
You should be making sure that the user is valid, or else show him an error. Your code does the except opposite, checking if the user is NOT valid, validating by default.

Consider the following:

$result = mysql_query("...") or die(mysql_error());
if(mysql_num_rows($result) == 1) {
  echo "Success! You are logged in!";
}
else {
  echo "Failure! Try again.";
}
 

Also note how I use the die() function there. Basically does the same thing the if statement after you query call does.

Problem solved. Thanks Atli.

[meeenow]

I think you are right and mysqli should be used instead