Member Avatar for marjan_m

Is there any problem wid ths code?

$name=$_POST['txtusername'];
$password=$_POST['txtpw'];
$result = mysql_query("SELECT username,pw FROM login");
while($row = mysql_fetch_array($result))
  {
 if($name=$row['username'] && $password=$row['pw'])
 $valid_user = 1;
 else
 $valid_user = 0;
  }
  
 if($valid_user=1)
 echo "You are logged in";
 else
 echo "Enter again";
  • 6 Contributors
  • 7 Replies
  • 101 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by Member #46692

Dani AI

Generated

Quick summary and practical next steps that build on points made by , , , and .

Your code suffers three separate issues: a logic/compare mistake that makes conditions always true or false, an inefficient design that scans the whole table, and insecure handling of credentials. Rather than trying to patch the loop, it is better to change the approach: ask the database for the matching user and then verify credentials securely in PHP.

For control flow: PHP does have break to exit a loop immediately if you need it, but exiting earlier is not a substitute for a better design. If you must loop, check values with strict comparisons and break when found, for example:

foreach ($rows as $r) {
    if ($r['username'] === $inputUser) {
        $found = true;
        break;
    }
}

Security and correctness checklist:

  • Stop fetching the whole table; filter in SQL and use parameterized queries (PDO or MySQLi prepared statements) to avoid injection.
  • Never store plain-text passwords. Store a salted hash and verify using the appropriate password verification function.
  • Use strict comparisons (===) for predictable behavior and avoid accidental assignments in conditional expressions.
  • On successful login, use secure session handling (regenerate session id, set secure cookie flags) and return minimal error messages (avoid revealing whether username or password was wrong).
  • Add rate limiting / account lockouts to slow brute-force attempts.
  • Replace deprecated mysql_* usage with modern extensions and add proper error handling and logging.

Addressing these points will fix the immediate bugs and make the login flow safe and maintainable.

Recommended Answers

All 7 Replies

Member Avatar for MitkOK

Hello.

There is no syntax error in this code, but
if you want to check a value of variable you
must use operator "==", not "=".

- Mitko Kostov

Member Avatar for marjan_m

Thankx for ur reply,bt can u plz let me know any function in PHP which can terminates the execution at any time like a "break" function in c++.As I want to terminate the loop as soon as it finds the correct match and $valid_user got value 1.

Regards,

Member Avatar for Member #46692

You can effectively do the same as "break" with just loops and a few conditions.

Member Avatar for Ezzaral 
while (!$validUser) {
  ...
}
Member Avatar for seagram

What is "wrong" with your code is that you do not take benefit of MySQL capabilities to check whether user exists and passwords match.
Instead, you code in PHP a loop to scan the whole 'login' table. As you pointed out yourself, you need a way to stop scanning as soon as you have found a row. But if the expected row if deep into 'login', or does not exist, you will still fetch a lot of rows for nothing.
Using a more elaborate SQL query, your code could be:

$name=$_POST['txtusername'];
$password=$_POST['txtpw'];
$result = mysql_query("SELECT username,pw FROM login WHERE username='$name' AND pw='$password'");
$nb_rows = mysql_num_rows($result);
switch ($nb_rows){
case 0: $valid_user = 0; break;
case 1: $valid_user = 1; break;
default: /* should never occur -> error management*/
} 
if($valid_user=1)
 echo "You are logged in";
else
 echo "Enter again";

However, there is a lot more to do, for instance checking $_POST variables for special characters or code injection. You will find plenty of information about that on the web.

Member Avatar for Eko 
if($valid_user=1)
 echo "You are logged in";

if($valid_user==1) :P

Member Avatar for Member #46692

if($valid_user==1) :P

This is a repeat of post #2

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.