regarding php session

[ravi951]

hi please tell me how to modify the code as u mentioned

[JShor]

<?php 
session_start();
mysql_connect("localhost","root","") or die(mysql_error());
mysql_select_db("shopping") or die(mysql_error()); 
$result = mysql_query("SELECT * FROM login WHERE username='" . mysql_escape_string($_POST['username']) . "' AND password='" . mysql_escape_string($_POST['password']) . "'"); 

// The array of data returned from MySQL.
$r = mysql_fetch_array($result);

$rows=mysql_num_rows($result);
if(!isset($_SESSION['username']))
{

// Check if the username/password matches, THEN set a session.
if($rows > 0) {
// Set session.
$_SESSION['username'] = $_POST['username'];
}

header("Location:products.php");
} 
else 
{
$_SESSION['username']= time();
header("Location:products.php");
}
?>

[ravi951]

thank you it helped me a lot

[ravi951]

in line $r = mysql_fetch_array($result);
the variable $r is never used any where in the code u posted

[JShor]

Whoops. I meant to change this line:

$_SESSION['username'] = $_POST['username']; 

...to this:

$_SESSION['username'] = $r["username"]; 

[ravi951]

whats the difference $_POST['username'] and $r['username']
make

[djr33]

They're different variables. $r is the row from the mysql query. $_POST is the post data as originally sent during the request from the browser (usually from a form).

[ravi951]

Whoops. I meant to change this line:

$_SESSION['username'] = $_POST['username']; 

...to this:

$_SESSION['username'] = $r["username"]; 

hi,
in the else part below
else
{
$_SESSION['username']= time();
header("Locationroducts.php");
}
this will be reached when both the username and password not matched.right..
my question is if both username and password are internally in the database
then there is no way of changing it.
since there is no way the passwords matching fails
then it will never direct to else part.is that so...

[djr33]

The query searches for the password based on the submitted (POST) username and submitted (POST) password. If any result is found that means the correct username and password were submitted. So, checking for a result is the same as verifying that the stored password is the same as the submitted password.

Honestly, I think you need to go through some introductory PHP tutorials, maybe some for MySQL also, so that you understand the basics. It's not easy to start with complicated scripts, but it won't at all to keep guessing about these things.


A good exercise to learn is to go through code and add comments for every line. What does that line do? Why is it there? How does it interact with code before and after? Once you understand what each line does, then you need to think about how it all fits together toward your goal. Then you'll begin to understand how PHP works.