Simple login checking password
mysql, php, sha
Solution
The problem is that your MySQL query is causing an error, which means that your `$result` doesn't actually contain a result resource.
You need to remove the `''` from around `SHA($password)` in your query, and instead put them around the password value, like so:
$query="SELECT username FROM users WHERE username='$username' AND password=SHA('$password')";
Also is the way I SHA the password correct?
That depends on how the passwords were hashed when they were inserted into the database. MySQL's `SHA()` is the same as its `SHA-1()`:
Calculates an SHA-1 160-bit checksum for the string, as described in RFC 3174
Which is also the same as PHP's `sha1()`; so, for example, if the passwords in the database are SHA-1 hashes that were created using PHP's `sha1()`, it should be fine.
Side Notes
You should use PHP's `crypt()` or `hash()` for hashing passwords, rather than SHA-1. For example usage, refer to the PHP documentation.
You should be cleaning/escaping all user-provided data before using any of it in a database query. This is to stop SQL injection attacks. Better yet, use prepared statements and parameterized queries. Refer to this answer for more information.
Problem
What am I doing wrong here: ``` <?php if (isset($_POST['submitted'])) { $errors = array(); require_once ('mysql_connect.php'); session_start(); $username = $_POST["username"]; // This is the inputted username from the form in Login.html $password = $_POST["password"]; // This is the inputted password from the form in Login.html if (empty($errors)) { $query="SELECT username FROM users WHERE username='$username' AND password='SHA($password)'"; $result = mysql_query($query); // Mysql_num_row is counting table row if (mysql_num_rows($result) == 1) { $_SESSION["username"] = $username; // Creates a cookie saving the username $_SESSION["loggedIn"] = true; // Creates a cookie saying the user is logged in // Show thank you message echo '<h3 style="color:green;">Thank You!</h3> <span style="color:green;">You have been logged in.</span>'; } else { echo '<font color="red">You could not be logged in, please make sure your username and password is correct.</font>'; foreach ($errors as $msg) { echo " - <font color=\"red\">$msg</font><br />\n"; } } } else { echo '<font color="red"><h3>Error!</h3> The following error(s) occured:<br /></font>'; foreach ($errors as $msg) { echo " - <font color=\"red\">$msg</font><br />\n"; } } } ?> ``` I get a: ``` Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /login.php on line 19 ``` Also is the way I SHA the password correct?