Member Avatar for mahase

Parse error: parse error, unexpected T_STRING in on line 21

21 = $query = “select * from users where username=’$username’ and password=’$password’”;

mysql_select_db("$dbname", $connection);

session_start();
$username = $_POST[‘username’];
$password = md5($_POST[‘password’]);

$query = “select * from users where username=’$username’ and password=’$password’”;

$result = mysql_query($query);

if (mysql_num_rows($result) != 1) {
$error = “Bad Login”;
include “login.html”;

} else {
$_SESSION[‘username’] = “$username”;
include “memberspage.php”;
}

?>

Thanks in Advance.

  • 3 Contributors
  • 2 Replies
  • 89 Views
  • 16 Hours Discussion Span
  • Latest Post Latest Post by hivenk

Dani AI

Generated

A parse error "unexpected T_STRING" usually means PHP encountered a string token where it did not expect one. The quick, common causes are mismatched or non-ASCII (typographic/smart) quotes, a missing semicolon or unmatched brace on the previous line, or stray characters copied from a word processor. was correct to point at the quotes — replace any angled or “curly” quotes with plain ASCII quotes and re-save the file as UTF-8 without BOM. Also lint the file with php -l filename.php to get a clearer pointer.

Beyond fixing the parse error, this login code should be modernized for security and forward-compatibility: do not use the old mysql_* API or simple MD5 hashing. Use prepared statements and PHP’s password hashing APIs instead. See the PHP manual on PDO and on password hashing for details and examples: PDO (PHP Manual) and password_hash / password_verify (PHP Manual).

Example of a safer approach (uses PDO and password_verify):

<?php
$pdo = new PDO('mysql:host=localhost;dbname=mydb;charset=utf8mb4', 'dbuser', 'dbpass', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

session_start();

if (!empty($_POST['user']) && !empty($_POST['pass'])) {
    $stmt = $pdo->prepare('SELECT id, pwd_hash FROM users WHERE username = :u LIMIT 1');
    $stmt->execute([':u' => $_POST['user']]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($row && password_verify($_POST['pass'], $row['pwd_hash'])) {
        $_SESSION['uid'] = $row['id'];
        header('Location: members.php');
        exit;
    } else {
        $error = 'Invalid login';
    }
}
?>

A note on earlier replies: a suggestion to remove quotes around variables can be misleading — SQL string delimiters belong in the query, but prepared statements remove the need for manual quoting altogether. During debugging, also enable full error reporting locally (error_reporting(E_ALL); ini_set('display_errors', 1);) and check file encoding and the line immediately before the reported error.

Recommended Answers

All 2 Replies

Member Avatar for ryan_vietnow 
$query = "select * from users where username='$username' and password='$password'";

replace your (”) with (") and (’) with (').

Member Avatar for hivenk

hi vietnow,

just remove single quotes around $username and $password.

other wise replace single quotes with " and followed by a .

both are fine

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.