Take the 2-minute tour ×

This is my script:

include "../inc/conn.php";
if ($_GET['login']=="yes") { 
 echo 'test2';
echo $username.' '.$password;
$userq=mysql_query("SELECT * FROM members WHERE username='$username' AND password='$password'") or die(mysql_error());
if (mysql_num_rows($userq)=="1") { $_SESSION['chkuser']="confirmed"; $_SESSION['username']=$user; }
else { echo 'Потребителското име и/или паролата са грешни. Моля опитайте отново.'; }
echo $user.' '.$pass;
if ($_SESSION['chkuser'] <> "confirmed") {
echo '<div align="center"><strong>Моля въведете име и парола</strong>:<br/><br/><br/>';
<form name="form1" method="post" action="?login=yes">
  Потребител: <input type="text" name="username"  />
    <p><input type="submit" name="Submit" value="Вход" /></p>

Test 2 is echoed, but username and password are not sent via POST - scripts breaks after $_POST is used.. Do you guys see where my error is ?

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Shouldn't this:





share|improve this answer
darn it, I'm an idiot.. thanks –  DreamWave Oct 28 '10 at 12:25
Don't forget to accept an answer! :) –  Drewdin Oct 28 '10 at 13:16
I'd never forget :) –  DreamWave Nov 1 '10 at 13:05
add comment

Use [], not () to get data from $_POST array:


Also, I might mention that you should escape user input before using it in mysql query:


If you don't do this, anyone can insert something like this:

password=blabbla' OR '1'='1

and will login as admin without knowing the password :)

share|improve this answer
$_POST('username'); what this actually does is call a function by the name that is the value of $_POST (which is an array, so it's probably an empty string in this case). These are called variable functions. –  Core Xii Oct 28 '10 at 12:49
@Core Xii, yes. But I doubt that the original intention was to use variable function :) –  Silver Light Oct 28 '10 at 13:05
I know. Just letting him know what his code actually did, as opposed to what it was supposed to do. (since it was technically correct syntax) –  Core Xii Oct 28 '10 at 17:14
add comment

Your Answer


