problems with login script

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • morph.1989@gmail.com
    #1

    problems with login script

    Hi, I can't get this script to work.
    I've used this exact script on other places and it works, but now i
    get this error.

    <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
    MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
    line 15 </code>

    I can't see what is wrong.
    Here is the script.

    <code>
    <?php
    session_start() ;
    $anvnamn = $_POST['usr'];
    $losenord = $_POST['pwd'];

    include "dbconnect.php" ;

    $anv2 = mysql_real_esca pe_string($anvn amn, $dbconnect);
    $los2 = mysql_real_esca pe_string($lose nord, $dbconnect);

    $sqlfraga = "SELECT anvnamn FROM administrator WHERE anvnamn = '" .
    $anvnamn . "' AND losen = '" . $losenord . "'";
    $res = mysql_query($sq lfraga, $dbconnect);

    if($rad = mysql_fetch_arr ay($res))
    {
    $_SESSION['logged_in_admi n'] = true;
    }
    else
    {
    $_SESSION['logged_in_admi n'] = false;
    }
    ?>
    <html>
    <body>
    <?php
    if($_SESSION['logged_in_admi n'])
    {
    echo("You are logged in");
    include('index. php');

    }
    else
    {
    echo ("go away");
    }
    ?>
    </body>
    </html>
    </code>
    Tags: None
    • Sjoerd
      #2
      Re: problems with login script

      On May 19, 1:36 pm, morph.1...@gmai l.com wrote:
      <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
      MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
      line 15 </code>
      >
      $res = mysql_query($sq lfraga, $dbconnect);
      if($rad = mysql_fetch_arr ay($res))
      When the query fails, mysql_query() returns false, which results in
      the error message you wrote. I am not sure if this is the case in your
      situation, because this would also print a warning. Check the output
      of mysql_query() and use mysql_error() to get the error message.



        Comment

        • Robin
          #3
          Re: problems with login script

          morph.1989@gmai l.com wrote:
          Hi, I can't get this script to work.
          I've used this exact script on other places and it works, but now i
          get this error.
          >
          <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
          MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
          line 15 </code>
          >
          I can't see what is wrong.
          Here is the script.
          >
          <code>
          <?php
          session_start() ;
          $anvnamn = $_POST['usr'];
          $losenord = $_POST['pwd'];
          >
          include "dbconnect.php" ;
          >
          $anv2 = mysql_real_esca pe_string($anvn amn, $dbconnect);
          $los2 = mysql_real_esca pe_string($lose nord, $dbconnect);
          You create some escaped versions of the $_POST data...
          $sqlfraga = "SELECT anvnamn FROM administrator WHERE anvnamn = '" .
          $anvnamn . "' AND losen = '" . $losenord . "'";
          .... but then fail to use them (SQL injection alert!).
          $res = mysql_query($sq lfraga, $dbconnect);
          Then fail to check whether $res is FALSE, which could be the case if
          there was an issue with rights to the database.
          if($rad = mysql_fetch_arr ay($res))
          Which would cause this to error as described.

          So, the error said that $res wasn't valid, so why didn't you check what
          was being used? Simple debugging...

          Robin

            Comment

            • Rik Wasmus
              #4
              Re: problems with login script

              On Mon, 19 May 2008 13:36:24 +0200, <morph.1989@gma il.comwrote:
              Hi, I can't get this script to work.
              I've used this exact script on other places and it works, but now i
              get this error.
              >
              <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
              MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
              line 15 </code>
              >
              I can't see what is wrong.
              Here is the script.
              >
              <code>
              <?php
              session_start() ;
              $anvnamn = $_POST['usr'];
              $losenord = $_POST['pwd'];
              >
              include "dbconnect.php" ;
              >
              $anv2 = mysql_real_esca pe_string($anvn amn, $dbconnect);
              $los2 = mysql_real_esca pe_string($lose nord, $dbconnect);
              Proper escaping and then:
              $sqlfraga = "SELECT anvnamn FROM administrator WHERE anvnamn = '" ..
              $anvnamn . "' AND losen = '" . $losenord . "'";
              .... using the unescaped variables!

              You, my friend, are vulnerable to SQL injection. Use the $avn2 & $los2
              variables in the query, that's why you escape()d them...

              If you still have the same problem, echo $sqlfraga & mysql_error() to the
              screen and check what's wrong with the query.
              --
              Rik Wasmus
              ....spamrun finished

                Comment

                • Rik Wasmus
                  #5
                  Re: problems with login script

                  On Mon, 19 May 2008 14:05:55 +0200, Robin <anon@somewhere .comwrote:
                  morph.1989@gmai l.com wrote:
                  >Hi, I can't get this script to work.
                  >I've used this exact script on other places and it works, but now i
                  >get this error.
                  > <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
                  >MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
                  >line 15 </code>
                  > I can't see what is wrong.
                  >Here is the script.
                  > <code>
                  ><?php
                  >session_start( );
                  >$anvnamn = $_POST['usr'];
                  >$losenord = $_POST['pwd'];
                  > include "dbconnect.php" ;
                  > $anv2 = mysql_real_esca pe_string($anvn amn, $dbconnect);
                  >$los2 = mysql_real_esca pe_string($lose nord, $dbconnect);
                  >
                  You create some escaped versions of the $_POST data...
                  >
                  >$sqlfraga = "SELECT anvnamn FROM administrator WHERE anvnamn = '"

                    Comment

                    • =?ISO-8859-1?Q?=22=C1lvaro_G=2E_Vicario=22?=
                      #6
                      Re: problems with login script

                      morph.1989@gmai l.com escribió:
                      Hi, I can't get this script to work.
                      I've used this exact script on other places and it works, but now i
                      get this error.
                      >
                      <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
                      MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
                      line 15 </code>
                      >
                      I can't see what is wrong.
                      Speaking in plain English, this error message means that you can't fetch
                      rows from $res because the database query failed. So you need to check
                      whether the query fails or not:
                      $res = mysql_query($sq lfraga, $dbconnect);
                      if(!$res){
                      // Error: log it, abort or whatever
                      echo 'Query failed: ' . mysql_error();
                      }else{
                      // Read rows
                      }

                      I also recommend you to enable full error reporting (at least in your
                      dev box). Edit your php.ini file or add this to the top of the script:

                      ini_set('displa y_errors', 1);
                      error_reporting (E_ALL);


                      --
                      -- http://alvaro.es - Álvaro G. Vicario - Burgos, Spain
                      -- Mi sitio sobre programación web: http://bits.demogracia.com
                      -- Mi web de humor al baño María: http://www.demogracia.com
                      --

                        Comment

                        • morph.1989@gmail.com
                          #7
                          Re: problems with login script

                          On May 19, 2:13 pm, "Álvaro G. Vicario"
                          <alvaroNOSPAMTH A...@demogracia .comwrote:
                          morph.1...@gmai l.com escribió:
                          >
                          Hi, I can't get this script to work.
                          I've used this exact script on other places and it works, but now i
                          get this error.
                          >
                          <codeWarning: mysql_fetch_arr ay(): supplied argument is not a valid
                          MySQL result resource in C:\xampp\htdocs \uploads\login_ script.php on
                          line 15 </code>
                          >
                          I can't see what is wrong.
                          >
                          Speaking in plain English, this error message means that you can't fetch
                          rows from $res because the database query failed. So you need to check
                          whether the query fails or not:
                          >
                          $res = mysql_query($sq lfraga, $dbconnect);
                          >
                          if(!$res){
                          // Error: log it, abort or whatever
                          echo 'Query failed: ' . mysql_error();
                          >
                          }else{
                          // Read rows
                          }
                          >
                          I also recommend you to enable full error reporting (at least in your
                          dev box). Edit your php.ini file or add this to the top of the script:
                          >
                          ini_set('displa y_errors', 1);
                          error_reporting (E_ALL);
                          >
                          --
                          --http://alvaro.es- Álvaro G. Vicario - Burgos, Spain
                          -- Mi sitio sobre programación web:http://bits.demogracia.com
                          -- Mi web de humor al baño María:http://www.demogracia.com
                          --
                          tanks for the help all of you guys.. the escaping being wrong i was
                          already aware of, i was in a bit of hurry when i set them up and i saw
                          that it was wrong just after posting this...
                          anyways the problem was that i named the table administrators in the
                          database and i wrote administrator in the querry, so all i really
                          needed was an "s"...

                            Comment

                            Previous template Next
                            Working...