CODEWITHSUNDEEP
phpmysqlhtml
Kroltan
Kroltan

Reputation: 5156

PHP/MYSQL - checking user identification from DB info

So, i am making kind of a blog system for my site, and i have 2 tables. One for storing users, their passwords and images (URLs), another for storing all the blog posts, with image_url, author, date and content. The relevant part of my HTML is:

<form action="../scripts/send.php" method="post"><input type="text" name="author" placeholder="Your name" style="width:30%;"/><input type="password" name="pass" placeholder="Password" style="width:30%;"/><br /><input type="text" name="title" placeholder="Post Title" style="width:60%;" /><br /><textarea name="content" rows="20" style="width:60%;"></textarea><br /><button >Post</button></form>

And my PHP code (send.php) is:

<?php
mysql_connect("localhost","kroltan","eclipsepdt123") or die("Can't connect to DB");
mysql_select_db("kroltan_main") or die("Can't select to DB");
$result = mysql_query("SELECT * FROM `users`") or die("Can't fetch data");
if(mysql_num_rows($result) > 0){
    while($row = mysql_fetch_assoc($result)){
        if ($row['name'] == strtolower($_POST['author'])){
            if ($row['pass'] == strtolower($_POST['pass'])){
                $name = $_POST['name'];
                $comm = $_POST['comment'];
                $result = mysql_query("INSERT INTO blog_posts (img_url, author, title, content) VALUES(".$row['img'].", ".$_POST['author'].", ".$_POST['title'].", ".$_POST['content'].")") or die("Can't send data");
                header("Location: /?/=Talk");
            }
        }
    }
}
?>

When i try to create a new post on the site, it does not work. I am not even redirected to the page

Upvotes: 0

Views: 262

Answers (3)

Vyktor
Vyktor

Reputation: 20997

I'm sorry, but that's terrible usage of mysql :)

At first, let's start with fixing your query:

$error = '';
if( isset( $_POST['user']) && isset( $_POST['pass'])){
    $user = mysql_real_escape_string( $_POST['user']);
    $pass = mysql_real_escape_string( $_POST['pass']);

    $q = mysql_query( "SELECT * FROM users WHERE user = '$user' AND pass '$pass'");
    if( !$q){
       $error = 'Query error: ' . mysql_error();
    } else {
        if( mysql_num_rows( $q)){
             // Redirect
        } else {
             $error = 'Wrong user name or password';
        }
    }
} else {
    $error = 'Missing post data.';
}
die( 'Error: ' . $error . "\n");

And MattyB provided great answer about how to fix your form.

Upvotes: 1

Crashspeeder
Crashspeeder

Reputation: 4311

You don't have a submit button. This is an HTML question, not a PHP/MySQL question.

<input type="submit" value="Post" />

Upvotes: 1

MattyB
MattyB

Reputation: 952

You don't want a button, you want an input of type submit:

<INPUT TYPE=submit VALUE="Post"/>

http://htmlhelp.com/reference/html40/forms/input.html

Upvotes: 0

Related Questions