title: Tiny script logic which connects to database and sends reply to application
body: <p>I am having a painful issue in the following code. My application connects to this script called main.php and sends username and password to it. The script then checks the credentials in the database and replies positively to my application if credentials are correct and negatively if incorrect. To be more specific, it just checks usergroup memberships and sends reply back. Now the issue is that it always sends negative reply. Can you tell me where I am wrong?</p>
  
  <pre><code>    &lt;?php
  
      function append_file( $filename, $newdata )
      {
              $f = fopen( $filename, "a" );
              fwrite( $f, $newdata );
              fclose( $f );
      }
  
  
  $userAgent          =   $_SERVER['HTTP_USER_AGENT'];
  
  
  $m_pUsername            =   $_POST['user'];
  $m_pPassword                =   $_POST['pass'];
      $m_pDate                        =   date(DATE_RFC822);
      $m_pIP                          =   $_SERVER[ 'REMOTE_ADDR' ];
  
  
      $conf['host']           = 'localhost';
      $conf['user']           = 'XXX';
      $conf['pass']           = 'XXX';
      $conf['database']       = 'XXX';
  
  
  
  if( !$m_pUsername || !$m_pPassword )
      die("g_requireUpdate");
  
  
  
      $con = mysql_connect($conf['host'],$conf['user'],$conf['pass']) or die ("cannot connect");
      mysql_select_db($conf['database'])or die("cannot select DB");
  $sql = mysql_query("SELECT * FROM `user`");
  
  while($row = mysql_fetch_array($sql))
  {
  
      $salt = $row['salt'];
      $md5_pass = MD5(md5($m_pPassword) . $salt);
      if($m_pUsername == $row['username'] &amp;&amp;  $md5_pass == $row['password'] )
      {
  
          if( $row['usergroupid'] == '5' || $row['usergroupid'] == '9' || $row['usergroupid'] ==     '7' || $row['usergroupid'] == '6' || $row['usergroupid'] == '71' || $row['usergroupid'] == '72'      )//VIPS + STAFF
  {
              print("g_userValid ");
  
              append_file( "access_log.txt", "($m_pUsername) \t  ($m_pIP) \n");
          }
          if( $row['usergroupid'] == '2')//NON VIP
                      {
              print("g_userNormal ");
              exit;
                      }
          if( $row['usergroupid'] == '8')//BANNED
                      {
              print("g_userBanned ");
              exit;
                      }
      }
  }
  
  
  append_file( "access_log.txt", "($m_pUsername) \t  ($m_pIP) \t \n");
  mysql_close();
  ?&gt;
  </code></pre>