a very simple query is not working PHP

i have a little problem with a very simple query , when i hard code the values in the query its working , but when i use a PHP variable nothing is retrieved , i over check a lot of things including the query , the database it worth saying that i'm getting the variable from a form by POST and also checked that i'm getting them but when i use them in a query they jst dont work :S

here's my code ..PLZ what am i doing wrong ?!!!!!!!!!!!

  <?php 

 $email = $_POST ['emailEnter'] ; 
$password = $_POST ['passwordEnter'];


$connection = mysql_connect('localhost','root','') ;

$db_selected = mysql_select_db("lab5" , $connection) ;

$query开发者_高级运维 = 'select * From user where email="$email" and password="$password" ' ;
$result = mysql_query ($query , $connection);
    while($row=mysql_fetch_array($result))
    {
        echo $row['name'];
    }
mysql_close($connection);       
?>

You use single quotes in the query variable. Single quotes does not substitute variables - so it looks for literal string $email not the variable email. Either use double quotes or even better use something like PDO which would do the work for you.

You should also sanitize your inputs from SQL/XSS vulnerabilities.

The basic debugging steps are 1. adding

if (!$result) echo "Error: ".mysql_error();

to see any errors from the SQL query and 2. outputting

echo "Query: $query";

to see what the variables contain. One of these will point you to the problem.

Also, your query is vulnerable to SQL injection. You should add a

$email = mysql_real_escape_string($email);
$password = mysql_real_escape_string($password );

after fetching the values from the POST array.

Your error probably resides in the fact that you don’t escape your parameters.

While you are at it, use MySQLi or PDO (maybe even some prepared statements)

Someone mentioned your use of single-quotes, that’s the real error, my bad.

But my advice still stands. Having used prepared statements, you wouldn’t have fell for that mistake

try

$query = 'select * From user where email="' . $email . '" and password="'. $password . '" ' ;

or

$query = "select * From user where email='$email' and password='$password'" ;

Try this instead:

$query = "select * From user where email='" . $email . "' and password='" . $password . "';

Then immediately change that to this instead:

$query = "select * From user where email='" . mysql_real_escape_string($email) . "' and password='" . mysql_real_escape_string($password) . "';

Try

$query = "SELECT * FROM user WHERE email = '".$email."' AND password = '".$password."'";

You've confused the single and double quotes

You have:

$query = 'select * From user where email="$email" and password="$password" ' ;

You want:

$query = "select * From user where email='$email' and password='$password' " ;

Single quotes evaluate to whats literally inside. Double quotes will parse for variables inside. Theres also a curly brace {$variable} syntax you can use.

Suggestions from other posters for using mysql_real_escape or using newer mysqli or PDO are important as well. At the very least use mysql_real_escape on parameters that come from user input.

the problem is the way you are quoting the variables. Suppose that $email= 'some@gmail.com' and $password= 'securenot'.

what we want is the final interpreted string to be the following

select * from user where email='some@gmail.com' and password='securenot'

to achieve this we simply replace the some@gmail.com for $email and securenot for $password and get the following:

select * from user where email='$email' and password='$password'.

and then in php code ...

$query = "select * from user where email='$email' and password='$password'";

hope that is of some help

mysql_fetch_assoc() for associative array. You cannot use normal array as assoc array.

while($row=mysql_fetch_assoc($result))
{
   echo $row['name'];
}