If statement is not working correctly

Question

This is my first topic so far in this great webpage

The problem is this:

I'm scripting an UCP (PHP & MySQL based). I want it to show the user's status like score, money, etc. (Yeah, it's for a game) but when I click on the login button nothing happens it just erases the content of the requested fields.

It was working properly before I made some changes (Checking if the username exists)

Here's the code:

if (isset($_POST['login'])) 
{
    $hashedpass = hash('whirlpool', $password); 
    $query = "SELECT * FROM users WHERE Username = '$playername' AND Password = '$hashedpass'";
    $result = mysql_query($query);

    $num = mysql_num_rows($result);
    mysql_close();
    if($num != 0)
    {
        echo"Account doesn't exist!";
        header("Location: ucp.html");
    }
    else 
    {

        $name=mysql_result($result,$i,"UserName");

        $money=mysql_result($result,$i,"Money");

        $score=mysql_result($result,$i,"Score");

        $wantedlevel=mysql_result($result,$i,"WantedLevel");

        $adminlevel=mysql_result($result,$i,"AdminLevel");


        echo "<b>$name</b><br>Money: $money<br>Score: $score<br>Wanted Level: $wantedlevel<br>Admin Level: $adminlevel<br><br>";        

    }   
}
else if (isset($_POST['register'])) 
{
    header("Location: register.html");
}
else 
{
    header("Location: index.html");
}

Check the return value of your query - does anything show in `mysql_error()`? — andrewsi, Dec 17 '13 at 03:29
`or die (mysql_error());` is useful thing to add to your script. During development — Sir, Dec 17 '13 at 03:30
You can't echo something and then set the headers. Headers must come first. — Jonathan M, Dec 17 '13 at 03:31
@user4035, it's also called immediately after `echo"Account doesn't exist!";`. You can't do that. — Jonathan M, Dec 17 '13 at 03:34
`mysql_query` and its related functions are no longer a correct way to access the database, and have not been for a long time. Please stop using them, they will be removed from PHP in the near future. — user229044, Dec 17 '13 at 03:58
You should also try logging in with username "`' OR 1=1 LIMIT 1 -- `" and then read up on sql injection. — Michael - sqlbot, Dec 17 '13 at 05:26

score 3 · Answer 1 · edited Dec 17 '13 at 03:42

3

if($num != 0)

change to:

if($num == 0)

edited Dec 17 '13 at 03:42

Funk Forty Niner

74,450
15
68
141

answered Dec 17 '13 at 03:33

Tom Lee

64
3

score 1 · Answer 2 · edited May 23 '17 at 12:03

This simply won't work here nor does it make much logical sense:

$num = mysql_num_rows($result);
mysql_close();
if($num != 0)
{
    echo"Account doesn't exist!";
    header("Location: ucp.html");
}

First the logic is wrong, if $num is NOT equal to 0 then your query MUST have found at least one account. So you need to change your if statement to:

if($num == 0){ //if 0 rows were found - the account was not found thus it doesn't exist
   echo "Account doesn't exist!";
}

Notice also i did not add header("location: ucp.html");. You cannot display output + relocate the user to another page. You either do one or the other, or you will get an error/warning.

Finally check your MYSQL is not causing an error by adding a check at the end with :

$result = mysql_query($query) or die(mysql_error());

Final tip, you should avoid using mysql_* and look into mysqli_* or PDO best explained here: Why shouldn't I use mysql_* functions in PHP?

If statement is not working correctly

2 Answers2