Hi,

<?php

require "connection.php";

$run = mysql_query($query);

$username = $_POST['username'];
$password = $_POST['password'];

$query = "SELECT 'ID' FROM '****' WHERE 'username' = '$username' AND 'password' = '$password' LIMIT 1";
$request = mysql_query($query);
$run = mysql_num_rows($request);

if($run==1){
		mysql_fetch_array($query);
		}
		else{
			echo "Not Correctos";
			}

?>


<form id="form1" name="form" method="post" action="login.php">
  <table border="0" cellspacing="0" cellpadding="0">
    <tr>
      <td>Username:</td>
      <td><label for="textfield"></label>
      <input type="text" name="username" id="textfield" /></td>
    </tr>
    <tr>
      <td>Password:</td>
      <td><label for="textfield2"></label>
      <input type="text" name="password" id="textfield2" /></td>
    </tr>
  </table>
  <p>
    <input type="submit" name="button" id="button" value="Login" />
  </p>
</form>

Whats wrong with this PHP code it doesn't work. I would like to login but I can't is there anything wrong

FarrisFahad

The first two aren't things causing your script to fail, but they definitely need addressing:

1. You are wide open for a SQL injection. Taking raw user input and putting it into a query is a bad idea, especially in a login script.

2. This is not how you store a user's password. If you are going to ask users to give you private information, you should take steps to ensure it is properly secured. Passwords should be stored as hashes, never as the raw string. See the following: http://www.itnewb.com/tutorial/Encry...BKDF2-Standard

3. You are using single quotes in place of backticks in your query. Single quotes are used to enclose literal strings, backticks are used with table and column names. In most cases you don't need to use backticks at all. Removed the quotes from 'ID', '****', 'username', and 'password'. Right now you are asking the DB if $username is the literal 'username'.

Also, mysql_fetch_array() should be given the result as parameter (in your case, the $request variable), not the query string.

Also, there is no reason why a script being written now should use the mysql_* functions. Use mysqli or PDO. Using prepared statements will fix your SQL injection problem.

Thank you guys so much you have really helped me
In that code I was only trying to successfully login the user and I did thanks to you guys
thanks NullPointer
thanks lizciz