Member Avatar for Sorcher

Does anyone else see the problem here? i get ""userdetails did not match""
But the $myusername is set correct.

error_reporting(E_ALL);

if($_POST['tSubmit']){
$points = $_POST['pointamount'];
$price = $_POST['price'];
$reciever = $_POST['reciever'];
$mypassword = $_POST['mypassword'];	
$myusername = $_POST['myusername'];	
include "../db_connect.inc.php";

$sql= "SELECT password, loginid FROM login WHERE username = '$myusername'"; 
$result = mysql_query($sql) or die("Couldn't execute query") ; 
$userDetails = mysql_fetch_assoc( $result ); 

// We should only get 1 result other wise error 
if (count($userDetails)  == 1) //this gives the "userdetails did not match" error
{
  // Compare the passwords 
  if (sha1($_POST['mypassword']) == $userDetails['password']) 
  {
  
  ////If myusername do not have a storage of points
  if(!is_file("../u/txt/userPoints/".$myusername.".txt")){
	$ourFileName = "../u/txt/userPoints/".$myusername.".txt";
	$ourFileHandle = fopen($ourFileName, 'w') or die("can't open file");
	fclose($ourFileHandle);
	$myFile = "../u/txt/userPoints/".$myusername.".txt";
	$fh = fopen($myFile, 'w') or die("can't open file");
	$stringData = "0";
	fwrite($fh, $stringData);
	fclose($fh);}else
  
  ////Check myusername's points
	$filename = "../u/txt/userPoints/".$myusername.".txt";
	$handle = fopen($filename, "r");
	$userPoints = fread($handle, filesize($filename));
	fclose($handle);
///If the user do not have enough points
	if($userPoints < $points){header("location: ../result.php?tp=nep");
///If the user send points to himself
	}elseif($reciever == $myusername){
		header("location: ../result.php?tp=rem");}
		
///Check if the reciever exist as a memeber
$sql= "SELECT `oginid FROM login WHERE username = '$reciever'"; 
$result = mysql_query($sql) or die("Couldn't execute query") ; 
$recieverDetails = mysql_fetch_assoc( $result );
mysql_free_result($result);
if (count($recieverDetails)  == 1) 
{
	if ($_POST['reciever'] == $recieverDetails['username'])
  {
	  ///Insert into MYSQL
	  $query = "
            INSERT INTO `ue-userfile2` (
              `from`,  `to`, `points`, `price`,`created`
            )
            VALUES ('{$userid}',
                '{$myusername}', '{$reciever}', '{$points}', {$price}, NOW()
            )";
			$result = mysql_query($query);
			if(!$result){header("location: ../result.php?tp=swwm");}
////The query was successful, now take away the points from myusername
	$filename = "../u/txt/userPoints/".$myusername.".txt";
	$fh = fopen($filename, 'w') or die("can't open file");
	$stringData = $userPoints - $points;
	fwrite($fh, $stringData);
	fclose($fh);
header("location: ../result.php?tp=snsi&r=".base64_encode($reciever)."");


  }
	
	
}else header("location: ../result.php?tp=nsu");


	

  
  
  
  
  
  
  } 
  else 
  { 
      // Incorrect password for username 
	  echo "wrong password";
  } 
} 
else 
{ 
  // Incorrect login somewhere 
  echo "userdetails did not match";
}  
}
  • 3 Contributors
  • 2 Replies
  • 207 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Immediate cause (most likely): the script is testing the wrong thing for “one row”. Calling count() on the array returned by a fetch counts columns, not rows, so a SELECT that returns password and loginid will give count(...) == 2 and the check fails. Use a row-count check before fetching or use a prepared-statement API that exposes the number of rows.

A small, modern example (no mysql extension copy-paste from the thread):

$stmt = $mysqli->prepare("SELECT password, loginid FROM login WHERE username = ?");
$stmt->bind_param('s', $myusername);
$stmt->execute();
$stmt->store_result();
if ($stmt->num_rows === 1) {
    $stmt->bind_result($db_hash, $loginid);
    $stmt->fetch();
    if (password_verify($mypassword, $db_hash)) { /* authenticated */ }
    else { echo "wrong password"; }
} else {
    echo "userdetails did not match";
}

Other immediate issues to fix (quick checklist):

  • Typo/syntax in the receiver SELECT (looks like a backtick/column-name typo); ensure the query actually returns the fields later code expects (e.g. username if comparing to recieverDetails['username']).
  • INSERT problems: column list, value count and variable order must match; avoid reserved names like from/to (or always backtick them) and ensure $userid is defined from the authenticated row.
  • File I/O: reading with fread(filesize(...)) on an empty file returns nothing; prefer file_get_contents() and cast to int, and use file_put_contents(..., LOCK_EX) to avoid race conditions. Example:
$userPoints = (int) trim(@file_get_contents($filename));
file_put_contents($filename, (string)($userPoints - $points), LOCK_EX);

Safety and debugging notes: follow and dump $_POST/use var_dump() to confirm inputs, enable error_reporting(E_ALL) and ini_set('display_errors',1) in dev, and temporarily append or die(mysql_error()) (or check $mysqli->error) after queries to see SQL errors. As suggested, add clearer error trapping and call exit() immediately after header("Location: ...") to stop further output. For long-term stability, migrate to mysqli/PDO with prepared statements and use password_hash/password_verify rather than raw SHA1, and store points in the database to avoid concurrency and integrity issues.

Recommended Answers

All 2 Replies

Member Avatar for almostbob

print the contents of the _post array, just to ensure they are what you expect, sometimes the error is not where you expect

Member Avatar for Member #120589

// Incorrect login somewhere

Perhaps if you tied down the error a little more rigorously? More error trapping.

I have to be honest I can't make head nor tail of the code flow due to your indenting.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.