MySQL query using url parameters in PHP

Question

First of all this is the first time i try PHP..

here is the code :

<?php
if (isset($_GET['name']) && isset($_GET['password']) 
$uname = $_GET['name'];
$pass = $_GET['password'];
$conn = mysql_connect("localhost","DBusername","DBpassword");
mysql_select_db("DBname",$conn);
$result = mysql_query("SELECT * FROM table WHERE username=$uname and password =$password");
$row  = mysql_fetch_array($result);
if(is_array($row)) {
$ip = $row[ip];
 echo $ip ;
}else {
echo = "Invalid Username or Password!";
}
?>

When i try this link : http://www.mywebsite.com/page.php?name=user&password=mypassword

This is a Hidden page, i use it to get my recorded members IP address, when a user tries to login in my Windows Form application which is written in C#

always get a blank page ..

thanks in advance

enable error logging? multiple syntax errors and bad practices — sunshinekitty
– sunshinekitty, Commented Mar 24, 2014 at 4:08
Note: You can use isset($_GET['name'], $_GET['password']) instead to clean things up. — Alex L
– Alex L, Commented Mar 24, 2014 at 4:32

Community · Accepted Answer · 2020-06-20 09:12:55Z

5

Surround your variables with single quotes and add a die(mysql_error()); at the end as shown.

$result = mysql_query("SELECT * FROM `dvtmembers` WHERE username='$uname' and password ='$pass'") or die(mysql_error());

Warning : Your code is open to SQL Injection attack.

Other Major Errors.

It should be $uname not $uanme
You have missed a parenthesis after the isset construct
You are doing an assignment to the echo statement.

Modified Code

<?php
ini_set('display_startup_errors',1);
ini_set('display_errors',1);
error_reporting(-1);

if (isset($_GET['name']) && isset($_GET['password']))
{
$conn = mysql_connect("localhost","DBusername","DBpassword");
mysql_select_db("DBname",$conn);
$uname = mysql_real_escape_string($_GET['name']);
$pass = mysql_real_escape_string($_GET['password']);
$result = mysql_query("SELECT * FROM table WHERE username='$uname' and password ='$pass'") or die(mysql_error());
$row  = mysql_fetch_array($result);
if(is_array($row)) {
    $ip = $row['ip'];
    echo $ip ;
}else {
    echo "Invalid Username or Password!";
}
}
else { echo "Name and Password was not passed !";}
?>

This(mysql_*) extension is deprecated as of PHP 5.5.0, and will be removed in the future. Instead, the MySQLi or PDO_MySQL extension should be used. Switching to PreparedStatements is even more better to ward off SQL Injection attacks !

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Mar 24, 2014 at 3:46

Shankar Narayana Damodaran

68.6k43 gold badges102 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Shankar Narayana Damodaran Over a year ago

@Dr.Vision, Have you enabled error reporting ?

Dr.Vision Over a year ago

Finally Worked, but always get "Invalid Username or Password!" however i type the name and pass correct..

Shankar Narayana Damodaran Over a year ago

Good. Have you added the single quotes around as shown in the code on the SELECT query ?

Dr.Vision Over a year ago

and fixed this (and password ='$password') to (and password ='$pass')

Dr.Vision Over a year ago

Warning: mysql_real_escape_string(): Access denied for user 'myrootnme'@'localhost' (using password: NO) in /home/myrootnme/public_html/mypage.php on line 8 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/myrootnme/public_html/mypage.php on line 8 Warning: mysql_real_escape_string(): Access denied for user 'myrootnme'@'localhost' (using password: NO) in /home/myrootnme/public_html/mypage.php on line 9 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/myrootnme/public_html/mypage.php on line 9

|

Ananth · Accepted Answer · 2014-03-31 16:32:38Z

2

use single quotes in $row['ip'] and variables also. Your query is vunerable ( SQl Injection) so better use mysql_real_escape_string() for parameters like name , password.

   <?php
echo "<br/> Outside loop"; 

   if (isset($_GET['name']) && isset($_GET['password']) {
echo "<br/> Inside if loop"; 

    $uname =  mysql_real_escape_string($_GET['name']);
    $pass =  mysql_real_escape_string($_GET['password']);
    $conn = mysql_connect("localhost","DBusername","DBpassword");

if($conn == false ){ echo "Database not connected. DB error. " ; } 
echo "<br/> after connection "; 

    mysql_select_db("Tablename",$conn);
echo "<br/> after db selection"; 

    $result = mysql_query("SELECT * FROM dvtmembers WHERE username= '$uname' and password = '$pass' ") or die(mysql_error());
    $row  = mysql_fetch_array($result);
    if(mysql_num_rows($result) > 0) {
    $ip = $row['ip'];
     echo $ip ;
echo "<br/>final If loop"; 

    }else {
echo "<Br/> final else loop"; 

    echo = "Invalid Username or Password!";
    }
}
else { 

echo "Parameters are not passed" ; 
} 
    ?>

edited Mar 31, 2014 at 16:32

answered Mar 24, 2014 at 3:48

Ananth

1,5823 gold badges17 silver badges36 bronze badges

1 Comment

Ananth Over a year ago

use this updated code above . and tell me what is the output ?

Collectives™ on Stack Overflow

MySQL query using url parameters in PHP

2 Answers 2

Modified Code

7 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Modified Code

7 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related