Linux, Apache, MySQL, PHP

mohammad masood ashrafi wrote:

is that stable and reliable?

Bastard Programmer from Hell

"SELECT `id` FROM `users` WHERE username= '$username' AND password='$pass'"

-<?php
	/**
	** handles the login feature of the sote 
	** check username and password with variables in the database
	*/
		
		require_once("../includes/ikobe.php");
		
		if (isset($_POST['username']) &&isset($_POST['password']))
		{
			$username = $_POST['username'];
			$password = $_POST['password'];
			var_dump($username,$password);
		
			$pass = sha1($password);
				
				 
				
				if (!empty($username) &&!empty($password))
				{
					$query = "SELECT 'id' FROM 'users' WHERE username= '$username' AND password= '$pass'";
														
					if ($query_run = mysql_query($query))
					{
						$query_num_row = mysql_num_rows($query_run);
						
							if ($query_num_row==0)
							{
								echo 'Invalid username / password combination';
								die();
							}
							else if ($query_num_row==1)
							{
								echo 'ok.';
							}
						
					}
				}
				else
				{
					echo 'You must supply a username and password.';
				}
		}
		
		

?>

<?php
/**
** handles the login feature of the site 
** check username and password with variables in the database
*/
require_once("../includes/ikobe.php");
		
if (isset($_POST['username']) && isset($_POST['password'])) {
	$username = $_POST['username'];
	$password = $_POST['password'];
			
	$pass = sha1($password);
				
	if (!empty($username) && !empty($password)) {
		$query = "SELECT id FROM users WHERE username = '$username' AND password='$pass' LIMIT 1";
		$query_run = mysql_query($query);
		$query_num_row = mysql_num_rows($query_run);
					
		if (mysql_num_rows($query_run) == 0) {
			echo 'Invalid username / password combination';
		} else {
			echo 'Ok.';
		}
			
	} else {
		echo 'You must supply a username and password.';
	}
}
?>

<?php
/**
** handles the login feature of the site
** check username and password with variables in the database
*/
require_once("../includes/ikobe.php");

if (isset($_POST['username']) && isset($_POST['password'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $pass = sha1($password);
    die($pass);

    if (!empty($username) && !empty($password)) {
        $query = "SELECT id FROM users WHERE username = '$username' AND password='$pass' LIMIT 1";
        $query_run = mysql_query($query);
        $query_num_row = mysql_num_rows($query_run);

        if (mysql_num_rows($query_run) == 0) {
            echo 'Invalid username / password combination';
        } else {
            echo 'Ok.';
        }

    } else {
        echo 'You must supply a username and password.';
    }
}
?>

<?php 
$query = "SELECT password FROM users WHERE username = 'joe' LIMIT 1";
$query_run = mysql_query($query);
while($row = mysql_fetch_array($query_run)){
    echo $row['password'];
}
?>

<?php
session_start();
mysql_connect('localhost', 'user', 'pass');
mysql_select_db('dbname');
if (isset($_POST['username']) && isset($_POST['password'])) {
	$username = $_POST['username'];
	$password = sha1($_POST['password']);
				
	if (!empty($username) && !empty($password)) {
		$query_run = mysql_query("SELECT id, password FROM users WHERE username = '$username' AND password = '$password' LIMIT 1");
							
		if (mysql_num_rows($query_run) == 0) {
			echo 'Invalid username / password combination';
		} else {
			echo 'Ok.';
		}
			
	} else {
		echo 'You must supply a username and password.';
	}
}
?>

<form action="" method="post">
 <label>Username:</label>
 <input type="text" name="username" size="10" value="<?php echo htmlentities("$username"); ?>" />

 <label>Password:</label>
 <input type="password" name="password" size="10" value="<?php echo htmlentities("$password"); ?>" />

 <input type="submit" name="login" value="Log In" />
 <input type="submit" name="join" value="Join" />
</form>