Php Basic Code

[ls101]

<?php

#host = "localhost";
#user = "root";
#pass = "pass";
#db = "test";

mysql_connect(#host, #user, #pass);
mysql_select_db(#db);

if (isset($_POST['username'])) {
	$username = $_POST['username'];
	$password = $_POST['password'];
	$sql = "SELECT " FROM users WHERE username='".#user."' AND password='".#pass."' LIMIT 1";
	#res = mysql_query($sql);
if (mysql_num_rows(#res) == 1) {
	echo "You have successfully logged in";
	exit();
} else {
	echo"Invalid Log In information. Please return to the previous page.";
	exit();
}
?>

What is wrong with this code? Can't figure it out!

[KillerK]

you are missing }

before the 2nd if

[Vapid - BANNED FOR LIFE]

Sql injection has gotten very advanced...

[freecartoonporn]

<?php

#host = "localhost";
#user = "root";
#pass = "pass";
#db = "test";

mysql_connect(#host, #user, #pass);
mysql_select_db(#db);

if (isset($_POST['username'])) {
	$username = $_POST['username'];
	$password = $_POST['password'];
	$sql = "SELECT " FROM users WHERE username='".#user."' AND password='".#pass."' LIMIT 1";
	#res = mysql_query($sql);
if (mysql_num_rows(#res) == 1) {
	echo "You have successfully logged in";
	exit();
} else {
	echo"Invalid Log In information. Please return to the previous page.";
	exit();
}
?>

What is wrong with this code? Can't figure it out!

shitloads of corrections/improvements can be made....

ref: http://www.w3schools.com/php/func_my...ape_string.asp

[Paul&John]

why is there #user instead of $user ?

[freecartoonporn]

why is there #user instead of $user ?

i thought its new way of declaring vars in latest php ....
duh.. me

[Paul&John]

i thought its new way of declaring vars in latest php ....
duh.. me

it is?