how to use if condition in perl

[vapanchamukhi]

i have written program to check whether the username and password entered are members of a company or not.... Im totally new to perl language... so please help me what is wrong with the following program..
thanx in advance...

#!/usr/bin/perl - w
 
use DBI;
use strict;
use CGI ':standard';
 
my $name = param('name');
my $password = param('password');
my $dbh = DBI->connect('DBI:mysql:test','root','') or die "Can't connect:" . DBI->errstr();
my $sth = $dbh -> prepare('select password from user where name = "$name"') or die "Can't prepare SQL: " . $dbh->errstr();
$sth -> execute() or die "Can't execute SQL: " . $sth -> errstr();
 
my($name1, $password1);
my $flag = 0;
 
while(($password1) = $sth->fetchrow()) 
{
if($password1)    
    print "$password1";
else {
    print "not member\n";
    break;
}
}
 
#if($password1)
#    print "microsoft member";
#else
#    print "not a microsoft member";
 
$sth->finish();
$dbh->disconnect();

[KevinADC]

one thing is if you use a scalar in a single-quoted string it will not be expanded but treated literally:

my $sth = $dbh -> prepare('select password from user where name = "$name"')

$name is the above line is literally $name and not whatever value the scalar $name has stored. Try this:

my $sth = $dbh -> prepare(qq{select password from user where name = "$name"})

There could be other problems with your code, but I did not check it all.

[Icecrack]

Please Post in Code Tags,

Also Use for more debug.

use CGI qw(:standard -debug);
use CGI::Carp qw(fatalsToBrowser);

take out:

use CGI ':standard';

also i would use the package (Module) Mysql
eg.

use Mysql;

i may have downloaded this but it makes life easy.

eg.

use Mysql;
 
$host = "127.0.0.1";
$database = "users_l";
$tablename = "users";
$user = " ";
$pw = " ";
 
$connect = Mysql->connect($host, $database, $user, $pw);
$connect->selectdb($database);
$myquery = "SELECT * FROM users WHERE init='$initc'";
$execute = $connect->query($myquery);
 
 
while (($id, $usern, $cleare, $init) = $execute->fetchrow_array())
    {
#check for user name and password match
#pass a flag 
}
 
 

[vapanchamukhi]

Please Post in Code Tags,

Also Use for more debug.

use CGI qw(:standard -debug);
use CGI::Carp qw(fatalsToBrowser);

take out:

use CGI ':standard';

also i would use the package (Module) Mysql
eg.

use Mysql;

i may have downloaded this but it makes life easy.

eg.

use Mysql;
 
$host = "127.0.0.1";
$database = "users_l";
$tablename = "users";
$user = " ";
$pw = " ";
 
$connect = Mysql->connect($host, $database, $user, $pw);
$connect->selectdb($database);
$myquery = "SELECT * FROM users WHERE init='$initc'";
$execute = $connect->query($myquery);
 
 
while (($id, $usern, $cleare, $init) = $execute->fetchrow_array())
    {
#check for user name and password match
#pass a flag 
}
 
 

where you have declared $initc?? what values it contains????

[Icecrack]

where you have declared $initc?? what values it contains????

$initc would be a param from form input

$initc=param('user');

another example:

 
 
use CGI qw(:standard -debug);
use CGI::Carp qw(fatalsToBrowser);
use Mysql;
 
 
$name=param('name');
$password=param('password');
 
 $host = "127.0.0.1";
 $database = "users_l";
 $tablename = "users";
 $user = " ";
 $pw = " ";
 
 $connect = Mysql->connect($host, $database, $user, $pw);
 $connect->selectdb($database);
 $myquery = "SELECT password FROM user WHERE name='$name'";
 $execute = $connect->query($myquery);
 
 
 while (($sqlpassword) = $execute->fetchrow_array())
     {
 
if ($password eq "$sqlpassword")
{
print "Login Accepted.";
}
elsif ($password ne "$sqlpassword")
{
print "Error Password Incorrect";
}
elsif ($sqlpassword eq undef)
{
print "User Not Found Please Try Again.";
}
}
 

Note: i would also check for perl and SQL cancel characters in the password and user param (never trust your users), as this could lead to unsecure program,

the use of ',;:/.%*)(^%$#@!`~+= try to cancel those characters. (also this will prevent future errors with SQL)

[KevinADC]

also i would use the package (Module) Mysql

I am pretty sure that module is considered obsolete, I don't even see it listed on CPAN anymore.

Edit:

I found it:

http://search.cpan.org/~rudy/DBD-mys...OLETE_SOFTWARE

[Icecrack]

I am pretty sure that module is considered obsolete, I don't even see it listed on CPAN anymore.

Edit:

I found it:

http://search.cpan.org/~rudy/DBD-mys...OLETE_SOFTWARE

My Bad i didn't read down a little more :P

They must of merged them MS SQL AND MY SQL

yes it's obsolete but still i think its a lot easier and cleaner.

[eWish]

People are also using Rose which is gaining popularity.


--Kevin

[eWish]

the use of ',;:/.%*)(^%$#@!`~+= try to cancel those characters. (also this will prevent future errors with SQL)

When making use of the DBI to connect to your database, you can use placeholders and bind values. Using this method will escape special characters for you. Thus your SQL won't complain.

--Kevin

[Icecrack]

When making use of the DBI to connect to your database, you can use placeholders and bind values. Using this method will escape special characters for you. Thus your SQL won't complain.

--Kevin

thanks for the update :)

[KevinADC]

People are also using Rose which is gaining popularity.


--Kevin

Wow, that started 3 or 4 years ago. Seems to be getting developed at a snails (a very slow snail) pace. I have never come across anyone that is actually using Rose.