[nani_nisha06]

Originally Posted by Redcoder

You should change this:


To:

PHP Code:

$sql="SELECT * FROM `".$tbl_name."` WHERE username='$myusername' and password='$mypassword'"; 


And another thing: escape input from the user to prevent SQL injection. Never trust input from the user.

HI redcoder,

As you suggested i have change my login script as below,

<?php session_start(); ?>
<?php
$host="localhost"; // Host name 
$username="testDBuser"; // Mysql username 
$password="1234"; // Mysql password 
$db_name="testdb"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = hash('sha256', $salt.$mypassword);
if (preg_match("/^\w{8,12}$/", $myusername, $matches))
{
$sql="SELECT * FROM `".$tbl_name."` WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
}
else 
{
   header("location: wrong.php");
}

if (mysql_num_rows($result) === 1) {

// Register $myusername, $mypassword and redirect to file "login_success.php"
$_SESSION['myusername']=$myusername;
}
$row=mysql_fetch_assoc($result);
if($row['usergroup']==1)  //normal user
{ 
header("location: /MYM/main.php"); 
}
elseif($row['usergroup']==0) //admin
{ 
header("location: /MYM/admin/admin_main.php"); 
}
else //If the username/password combination has not been found in the dbase
{ 
header("location: wrong.php");  
}
?>

But, Now I see when i am trying to use the admin login it is redirecting correctly. In case of normal user login I see it is redirecting me to unknown extension to "admin/index.html".

More over, I see preg_match("/^\w{8,12}$/", $myusername, $matches) doesn't work for me ?? .

Any suggestion....even i am thinking about Sql injection will get some what over leaded by implementing preg_match().

Regards,
nani