MySQL query using url parameters in PHP

mysql, php, url-parameters

Solution

Surround your variables with single quotes and add a `die(mysql_error());` at the end as shown.

$result = mysql_query("SELECT * FROM `dvtmembers` WHERE username='$uname' and password ='$pass'") or die(mysql_error());

Warning : Your code is open to SQL Injection attack.

Other Major Errors.

- It should be `$uname` not `$uanme`

- You have missed a parenthesis after the `isset` construct

- You are doing an assignment to the `echo` statement.

Modified Code

<?php
ini_set('display_startup_errors',1);
ini_set('display_errors',1);
error_reporting(-1);

if (isset($_GET['name']) && isset($_GET['password']))
{
$conn = mysql_connect("localhost","DBusername","DBpassword");
mysql_select_db("DBname",$conn);
$uname = mysql_real_escape_string($_GET['name']);
$pass = mysql_real_escape_string($_GET['password']);
$result = mysql_query("SELECT * FROM table WHERE username='$uname' and password ='$pass'") or die(mysql_error());
$row  = mysql_fetch_array($result);
if(is_array($row)) {
    $ip = $row['ip'];
    echo $ip ;
}else {
    echo "Invalid Username or Password!";
}
}
else { echo "Name and Password was not passed !";}
?>

This(`mysql_*`) extension is deprecated as of `PHP 5.5.0`, and will be removed in the future. Instead, the `MySQLi` or `PDO_MySQL` extension should be used. Switching to `PreparedStatements` is even more better to ward off SQL Injection attacks !

Problem

First of all this is the first time i try PHP.. here is the code : ``` <?php if (isset($_GET['name']) && isset($_GET['password']) $uname = $_GET['name']; $pass = $_GET['password']; $conn = mysql_connect("localhost","DBusername","DBpassword"); mysql_select_db("DBname",$conn); $result = mysql_query("SELECT * FROM table WHERE username=$uname and password =$password"); $row = mysql_fetch_array($result); if(is_array($row)) { $ip = $row[ip]; echo $ip ; }else { echo = "Invalid Username or Password!"; } ?> ``` When i try this link : http://www.mywebsite.com/page.php?name=user&password=mypassword This is a Hidden page, i use it to get my recorded members IP address, when a user tries to login in my Windows Form application which is written in C# always get a blank page .. thanks in advance

Original source