hallo iedereen

ik heb hier een login form en kan de fout er niet uitvinden de email activation en register werkt allemaal maar de login form niet kunnen jullie me verder helpen

<?php
error_reporting(E_ALL ^ E_NOTICE);
session_start();
$username = $_SESSION['userid'];
$username = $_SESSION['username'];
?>
<!DOCTYPE html>
<html>

  <head>
        <title>Login Page</title>

  </head>

  <body>
<?php

if($username && $userid){
	
	echo "You are already logged in as <b>$username</b> <a href='./member.php'>click here</a> to go to the member page";
	
}else{
$form = "<form action='./login.php' method='POST'>
<table>
<tr>
	<td>Username:</td>
	<td><input type='text' name='user'/></td>
</tr>
<tr>
	<td>Password:</td>
	<td><input type='password' name='password'/></td>
</tr>
<tr>
	<td></td>
	<td><input type='submit' name='loginbtn' value='Login'/></td>
</tr>
<tr>
	<td></td>
	<td><a href='./register.php'>Register</a> <a href='./forgetpass.php'>Forget your Password?</a></td>
</tr>
</table>
</form>";
if ($_POST['loginbtn']){
	$user = $_POST['user'];
	$password = $_POST['password'];
	if($user){
		if($password){
			require("connect.php");
			
			$password = md5(md5("asddsfnkelknd".$password)."kfdgklndfg");
			
			// make sure login info correct
			
			$query= mysql_query("SELECT * FROM members WHERE username='$user' ") or die( mysql_error());
			$numrows = mysql_num_rows($query) or die( mysql_error());
			if($numrows == 1){
				$row = mysql_fetch_assoc($query) or die( mysql_error());
				$dbid = $row['id'] or die( mysql_error());
				$dbuser = $row['username'] or die( mysql_error());
				$dbpass = $row['password'] or die( mysql_error());
				$dbactive = $row['emailactivated'] or die( mysql_error());
				
				if ($password === $dbpass){
					if($dbactive == 1){
						echo "You have logged in as <b>$dbuser</b> <a href='./member.php'>click here</a> to go to the member page";
						// set session info
						$_SESSION['userid'] = $dbid ;
						$_SESSION['username'] = $dbuser;
						mysql_close();
						
						
					}else{
						echo "You must activate your account using your email. $form";
						mysql_close();
					}
					
				}else{
					echo "Your username or password are incorrect. $form";
					mysql_close();
				}
				
			}else
				echo "Username is not found. $form";
				mysql_close();
			
			
			
		
		}else
			echo "You must enter your password. $form";
			mysql_close();
	}else
		echo "You must enter your username. $form";
	
}else
	echo "$form";
}
?>
  </body>
</html>
dan krijg ik dit nando a1e4097967ca1a8a89d293f435ae6b2f ergens nando getcountry [email protected] member 0 277de7c8b08daffb2ba73de61fd87cb5You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 2
Er staan geen quotes om $getemail.

Daarnaast lijk je ook geen escaping van DATA-delen in je SQL te gebruiken, wat een recipe for disaster is.

En dan gebruik je mysql_-functies, die zijn al 10 jaar verouderd en gaan op korte/middellange termijn verdwijnen.

Als je nieuwe code schrijft, gebruik dan mysqli of PDO, maar geen mysql_-functies.
die quotes die heb ik verholpen toen stond die error er nog steeds maar ik zal is kijken naar mysqli en PDO bedankt voor jullie antwoorden

Reageren