Member Avatar for wilko1995

Hi all,

<?php
$con = mysql_connect('localhost','root','');

if (!$con)
	{
	die("Could not connect: " . mysql_error());
	}

mysql_select_db('users',$con);

$sql="SELECT username FROM users_info";
$user = $_POST[username]
if($sql != $user)
	{
	die("Error: Username is not in our database! Make sure you check the spelling.");
	}
else
	{
	redirect('/users/' ->$user);
	}
mysql_close($con);

?>

The problem is when i type in a username on my form and it comes to this code, it says:

Parse error: syntax error, unexpected T_IF in ***/login.php on line 13

i know the user i typed in is correct.
Thanks for any help

Edited by wilko1995 because: n/a
  • 4 Contributors
  • 10 Replies
  • 115 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by karthik_ppts

Dani AI

Generated

The original parse error came from a simple syntax mistake (missing semicolon) and an unquoted array index in the first post; later logic failed because a resource returned by mysql_query() was being compared directly to the input string. correctly flagged the _POST quoting issue, and / @karthikppts were right to check the query result count — those fixes address symptoms but still rely on the old `mysql*` extension (removed in modern PHP). For a reliable, secure login check, use prepared statements (PDO or mysqli), normalize the username, and avoid exposing raw DB errors.

Use PDO with a parameterized query and a safe redirect. This example checks existence only (no password/authentication shown) and normalizes case; adapt it to verify a password with password_verify() when needed.

<?php
$dsn = 'mysql:host=127.0.0.1;dbname=users;charset=utf8mb4';
$opts = [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::ATTR_EMULATE_PREPARES => false];
$pdo = new PDO($dsn, 'dbuser', 'dbpass', $opts);

$username = isset($_POST['username']) ? trim($_POST['username']) : '';
if ($username === '') { exit('Missing username'); }

$stmt = $pdo->prepare('SELECT 1 FROM users_info WHERE LOWER(username) = :u LIMIT 1');
$stmt->execute([':u' => mb_strtolower($username)]);
if ($stmt->fetchColumn()) {
    header('Location: /user/' . rawurlencode($username) . '.php');
    exit;
}
exit('Error: Username not found');
?>

Notes and cautions:

  • Do not use mysql_* functions; use PDO or mysqli (see the PHP manual for PDO).
  • For real authentication, store hashed passwords and use password_hash() / password_verify() (see PHP docs).
  • Trim and normalize usernames to match DB collation, or use COLLATE/LOWER() in the query for case-insensitive checks.
  • Always exit after a Location header, escape URL segments with rawurlencode(), and use HTTPS + secure session handling for login flows.

Recommended Answers

All 10 Replies

Member Avatar for karthik_ppts

where du you execute your query? I think you missed it.
and at the end og your 12th line you missed semicolon.

Edited by karthik_ppts because: n/a
Member Avatar for wilko1995 
<?php
$con = mysql_connect('localhost','root','');

if (!$con)
	{
	die("Could not connect: " . mysql_error());
	}

mysql_select_db('users',$con);

$sql= mysql_query("SELECT username FROM user_info");
$user = "$_POST[username]";
if($sql != $user)
	{
	die("Error: Username is not in our database! Make sure you check the spelling.");
	}
else
	{
	redirect('/user/' . $user . '.php');
	}
mysql_close($con);

?>

I updated the code but it comes back with "Error: Username is not in our database! ...". it dies then posts that because APPARENTLY the user im using is not in the data base. HELP :S

Edited by wilko1995 because: n/a
Member Avatar for Stefano Mtangoo

1. remove quotes in $user = "$_POST[username]";

$user = $_POST['username'];

2. $sql= mysql_query("SELECT username FROM user_info"); ===> It seems you don't know what you are doing (copy and paste?). Check this and come back if you have any question!

Edited by Stefano Mtangoo because: n/a
Member Avatar for wilko1995 
<?php
$con = mysql_connect('localhost','root','');

if (!$con)
	{
	die("Could not connect: " . mysql_error());
	}

mysql_select_db('users',$con);

$sql= mysql_query("SELECT * FROM users_info");
$user = $_POST['username'];
if($sql['username'] != $user)
	{
	die("Error: Username is not in our database! Make sure you check the spelling.");
	}
else
	{
	redirect('/user/' . $user . '.php');
	}
mysql_close($con);

?>

Is that how its meant to be?
It executes 'die' when the username is correct... HELP?

Member Avatar for vibhaJ

I have changed select query.
Check this.

<?php
$con = mysql_connect('localhost','root','');

if (!$con)
{
	die("Could not connect: " . mysql_error());
}

mysql_select_db('users',$con);
$user = $_POST['username'];
$result= mysql_query("SELECT * FROM users_info WHERE username='".$user."'");
if (mysql_num_rows($result) == 0)
{
	die("Error: Username is not in our database! Make sure you check the spelling.");
}
else
{
	redirect('/user/' . $user . '.php');
}
mysql_close($con);

?>
Member Avatar for karthik_ppts

try this

<?php
    $con = mysql_connect('localhost','root','');
     
    if (!$con)
    {
    die("Could not connect: " . mysql_error());
    }
     
    mysql_select_db('users',$con);
     
    $sql= mysql_query("SELECT * FROM users_info where username='".$_POST['username']."'");
    $nor = mysql_num_rows($sql);
    if($nor > 0)
    {
    	redirect('/user/' . $user . '.php');
    }
    else
    {
    	die("Error: Username is not in our database! Make sure you check the spelling.");
    }
    mysql_close($con);
     
?>

and you need to practice more... refer this http://www.w3schools.com/php/default.asp

Member Avatar for karthik_ppts

Vibha, I haven't see your post. I think we posted in the same time.

Member Avatar for vibhaJ

NP karthik :)

Edited by vibhaJ because: n/a
Member Avatar for wilko1995

Thanks for you help, It works..

:)

Edited by wilko1995 because: n/a
Member Avatar for karthik_ppts

ok.. Mark as solved if your problem solved..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.