Using javascript alert in php

Question

I am working on a site where I am fetching records from database to match with the user input, if the data does not match with the details in database it must show an javascript alert box. But the problem is the javascript box is showing on body load too. Following is my code :

//Storing the value of form's username and password into PHP variables
$username = $_POST['username'];
$password = $_POST['password'];
//This query is to check whether ther user has provided valid details
$query = mysql_query("Select * from accounts where username='$username' and     password='$password'");
$status = mysql_num_rows($query);
/**Now checking whether the number of rows returned by database are greater than 0 to  verify the login
if number of rows are greater than zero we will redirect the user to index page with a     session variable**/

if($status >0)
{
$_SESSION['username'] = $username;
?>
<meta http-equiv="refresh" content="0;url=index.php">
<?}
else
{?>
<script language="javascript">
alert('UserName or Password does not match. Please try again');
</script>
<?}?>

warning your code is extremely vulnerable to sql injection attacks. also you should never store users passwords in the database. — Daniel A. White
– Daniel A. White, Commented Nov 9, 2012 at 12:37
@Jessica Brownie to complete what Daniel said, I suggest you look for password hashing (and never hash only the password, always include a salt and other parts like the username if it's constant). — Denys Séguret
– Denys Séguret, Commented Nov 9, 2012 at 12:38
Jessica, what page is this on? Can you show the form? Can you show more code that precedes this fragment? — phant0m
– phant0m, Commented Nov 9, 2012 at 12:47
I think she's trying to learn using PHP inside HTML pages. One step at a time. Don't confuse her with injections before she learns it. — Taha Paksu
– Taha Paksu, Commented Nov 9, 2012 at 12:47

Denys Séguret · Accepted Answer · 2012-11-09 12:47:21Z

1

Replace

else

with

else if (isset($_POST['username'])) {

if you don't want the alert to appear when the user isn't trying to log in.

answered Nov 9, 2012 at 12:47

Denys Séguret

384k90 gold badges813 silver badges779 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Taha Paksu · Accepted Answer · 2012-11-09 12:45:37Z

0

You need a login flag for this.

Add this to your form:

<input type="hidden" name="login_process" value="true" />

and then surround your login code with:

if($_POST["login_process"] == "true"){ 

    //your login code

}

...your page body

answered Nov 9, 2012 at 12:45

Taha Paksu

15.6k2 gold badges50 silver badges83 bronze badges

Comments

Ketan Patel · Accepted Answer · 2012-11-09 13:00:00Z

you miss <?php and Varible
    this Code Use then Check
       <?php 

            $username = $_POST['username'];
            $password = $_POST['password'];

            //This query is to check whether ther user has provided valid details
            $query = mysql_query("Select * from accounts where username='".$username."' and     password='**".$password."**'");
            $status = mysql_num_rows($query);

            /**Now checking whether the number of rows returned by database are greater than 0 to  verify the login if number of rows are greater than zero we will redirect the user to index page with a session variable**/

            if($status >0)
            {
               $_SESSION['username'] = $username;
            ?>
            <meta http-equiv="refresh" content="0;url=index.php">
            **<?php** }
            else
            {?>
            <script language="javascript">
            alert('UserName or Password does not match. Please try again');
            </script>
            **<?php** }?>

Collectives™ on Stack Overflow

Using javascript alert in php

3 Answers 3

Comments

Comments

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Linked

Related