用户登录不起作用？

Question

The database is working, but when I try to login with the info I signed up with it just tells me information is incorrect as I told it to say that but I know info is right. I do not see a problem below so any help is 100% appreciated. Please note Im new to coding to. If you need to see more code I can post. Also I am only using md5 as I was told to sub that in for now and it should work but still nope.

Thanks!

//User login
if (isset($_POST["user_login"]) && isset($_POST["password_login"])) {
    $user_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["user_login"]); // filter everything but numbers and letters
    $password_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["password_login"]); // filter everything but numbers and letters
    $password_login_md5 = md5($password_login);
    $sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND password='$password_login_md5 LIMIT 1"); // query
       //Check for their existence
       $valid = md5($password, $hash) === $hash;
       if ($userCount == 1) {
           while($row = mysql_fetch_array($sql)){
                    $id = $row["id"];
       }
           $_SESSION["user_login"] = $user_login;
           header("location: home.php");
           exit();
           } else {
           echo 'That information is incorrect, try again';
           exit();
       }
}

?>
                <div style="width: 800px; margin: 0px auto 0px auto;">
                <table>
                        <tr>
                            <td width="60%" valign="top">
                                  <h2>Already a member? Sign in below!</h2>
                                  <form action="index.php" method="POST">
                                         <input type="text" name="user_login" size="25" placeholder="Username" /><br /><br />
                                         <input type="text" name="password_login" size="25" placeholder="Password" /><br /><br />
                                         <input type="submit" name="login" size="25" value="Login!" />

Sign up form.

<?php include ( "./inc/header.inc.php" ); ?>
<?php
$reg = @$_POST['reg'];
//declaring variables to prevent errors
$fn = ""; //First Name
$ln = ""; //Last Name
$un = ""; //Username
$em = ""; //Email
$em2 = ""; //Email 2
$pswd = ""; //Password
$pswd2 = ""; //Password 2
$d = ""; //Sighn up date and time
$u_check = ""; // Check if username exists
//registration form
$fn = strip_tags(@$_POST['fname']);
$ln = strip_tags(@$_POST['lname']); 
$un = strip_tags(@$_POST['username']); 
$em = strip_tags(@$_POST['email']); 
$em2 = strip_tags(@$_POST['email2']); 
$pswd = strip_tags(@$_POST['password']); 
$pswd2 = strip_tags(@$_POST['password2']); 
$d = date("Y-m-d"); //Year - Month - Day

if ($reg) {
if ($em==$em2) {
// Check if user already exists
$u_check = mysql_query("SELECT username FROM users WHERE username='$un' ");
// Count the amount of rows where username - $un
$check = mysql_num_rows($u_check);
if ($check == 0) {
// Check all of the fields have been filed in
if ($fn&&$ln&&$un&&$em&&$em2&&$pswd&&$pswd2) {
// Check that passwords match
if ($pswd==$pswd2) {
// Check the maximum length of username/first name/last name does not exceed 25 characters
if (strlen($un)>25||strlen($fn)>25||strlen($ln)>25) {
echo "The maximum limit for username/first name/last name is 25 characters!";
}
else
{
// Check the maximum length of password does not exceed 30 characters and is not less than 5 characters
if (strlen($pswd)>30||strlen($pswd)<5) {
echo "Your password must be between 5 and 30 characters long!";
}
else
{
//encrypt password and password 2 using md5 before sending to database
$pswd = md5($pswd);
$pswd2 = md5($pswd2);
$query = mysql_query("INSERT INTO users VALUES (' ','$un','$fn','$ln','$em','$pswd','$d','0')");
die("<h2>Welcome to YouBook</h2>Login to your account to get started!");
}
}
}
else {
echo "Your passwords don't match!";
}
}
else
{
echo "Please fill in all of the fields!";
}
}
else
{
echo "Username already taken!";
}
}
else {
echo "Your E-mails don't match!";
}
}

Edit (03/30/2014)

All new code put together.

<?php include ( "./inc/header.inc.php" ); ?>
<?php
$reg = @$_POST['reg'];
//declaring variables to prevent errors
$fn = ""; //First Name
$ln = ""; //Last Name
$un = ""; //Username
$em = ""; //Email
$em2 = ""; //Email 2
$pswd = ""; //Password
$pswd2 = ""; //Password 2
$d = ""; //Sighn up date and time
$u_check = ""; // Check if username exists
//registration form
$fn = strip_tags(@$_POST['fname']);
$ln = strip_tags(@$_POST['lname']); 
$un = strip_tags(@$_POST['username']); 
$em = strip_tags(@$_POST['email']); 
$em2 = strip_tags(@$_POST['email2']); 
$pswd = strip_tags(@$_POST['password']); 
$pswd2 = strip_tags(@$_POST['password2']); 
$d = date("Y-m-d"); //Year - Month - Day

if ($reg) {
if ($em==$em2) {
// Check if user already exists
$u_check = mysql_query("SELECT username FROM users WHERE username='$un' ");
// Count the amount of rows where username - $un
$check = mysql_num_rows($u_check);
if ($check == 0) {
// Check all of the fields have been filed in
if ($fn&&$ln&&$un&&$em&&$em2&&$pswd&&$pswd2) {
// Check that passwords match
if ($pswd==$pswd2) {
// Check the maximum length of username/first name/last name does not exceed 25 characters
if (strlen($un)>25||strlen($fn)>25||strlen($ln)>25) {
echo "The maximum limit for username/first name/last name is 25 characters!";
}
else
{
// Check the maximum length of password does not exceed 30 characters and is not less than 5 characters
if (strlen($pswd)>30||strlen($pswd)<5) {
echo "Your password must be between 5 and 30 characters long!";
}
else
{
//encrypt password and password 2 using md5 before sending to database
$pswd = md5($pswd);
$pswd2 = md5($pswd2);
$query = mysql_query("INSERT INTO users VALUES (' ','$un','$fn','$ln','$em','$pswd','$d','0')");
die("<h2>Welcome to YouBook</h2>Login to your account to get started!");
}
}
}
else {
echo "Your passwords don't match!";
}
}
else
{
echo "Please fill in all of the fields!";
}
}
else
{
echo "Username already taken!";
}
}
else {
echo "Your E-mails don't match!";
}
}


if (isset($_POST["user_login"]) && isset($_POST["password_login"])) {

    // filter everything but numbers and letters
    $user_login = strip_tags($_POST['user_login']);
    $password_login = strip_tags($_POST["password_login"]);

    // md5 to hide the password
    $password_login_md5 = md5($password_login);

    // check for user in the database
    $sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND password='$password_login_md5' LIMIT 1");

    // checck how many results were found
    $usercount = mysql_num_rows($sql);

    if ($userCount == 1) {

        // if there's only one row, you don't need a while loop as it will only loop once anyway.
        $row = mysql_fetch_array($sql);

        // set the ID of the user
        $id = $row["id"];

        // set the user login to session
        $_SESSION["user_login"] = $user_login;

        // redirect user and exit
        header("location: home.php");
        exit();

    } else {

        // a user was not found with that password, show an error
        echo 'That information is incorrect, try again.';
        exit();

    }

}


?>
                <div style="width: 800px; margin: 0px auto 0px auto;">
                <table>
                        <tr>
                            <td width="60%" valign="top">
                                  <h2>Already a member? Sign in below!</h2>
                                  <form action="index.php" method="POST">
                                         <input type="text" name="user_login" size="25" placeholder="Username" /><br /><br />
                                         <input type="text" name="password_login" size="25" placeholder="Password" /><br /><br />
                                         <input type="submit" name="login" size="25" value="Login!" />
                                  </form>
                            </td>
                            <td width="40%" valign="top">
                                  <h2>Sign Up Below!</h2>
                                  <form action="index.php" method="POST">
                                         <input type="text" name="fname" size="25" placeholder="First Name" /><br /><br />
                                         <input type="text" name="lname" size="25" placeholder="Last Name" /><br /><br />
                                         <input type="text" name="username" size="25" placeholder="Username" /><br /><br />
                                         <input type="text" name="email" size="25" placeholder="Email Address" /><br /><br />
                                         <input type="text" name="email2" size="25" placeholder="Email Address (again)" /><br /><br />
                                         <input type="text" name="password" size="25" placeholder="Password" /><br /><br />
                                         <input type="text" name="password2" size="25" placeholder="Password (again)" /><br /><br />
                                         <input type="submit" name="reg" size="25" value="Sign Up!" />
                                  </form>
                            </td>
                        </tr>
                </table>
<?php include ( "./inc/footer.inc.php" ); ?>

Answer 1

0) You're missing the closing quote on your password ->

$sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND password='$password_login_md5' LIMIT 1"); // query

1) $userCount doesn't seem to be defined anywhere.

$usercount = mysql_num_rows($sql);
1f ($userCount == 1) {...}

It helps to keep your code clean as well, especially when you're learning. Try this.

if (isset($_POST["user_login"]) && isset($_POST["password_login"])) {

    // filter everything but numbers and letters
    $user_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["user_login"]); 
    $password_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["password_login"]);

    // md5 to hide the password
    $password_login_md5 = md5($password_login);

    // check for user in the database
    $sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND password='$password_login_md5' LIMIT 1");

    // checck how many results were found
    $usercount = mysql_num_rows($sql);

    if ($userCount == 1) {

        // if there's only one row, you don't need a while loop as it will only loop once anyway.
        $row = mysql_fetch_array($sql);

        // set the ID of the user
        $id = $row["id"];

        // set the user login to session
        $_SESSION["user_login"] = $user_login;

        // redirect user and exit
        header("location: home.php");
        exit();

    } else {

        // a user was not found with that password, show an error
        echo 'That information is incorrect, try again';
        exit();

    }

}

EDIT

One more tip..

Check your query for errors

$sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND password='$password_login_md5' LIMIT 1") or die(mysql_error());

you may have misspelled something or not even be connected to the database at all.

EDIT II

You have to handle the username and password exactly the way you handle it your sign up form, if you strip_tags the password before inserting it then you have to strip_tags it before you check it. If you preg_replace it in the login form, but didn't in the sign up form then of course it will be different.

you need to remove these lines

$user_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["user_login"]); 
$password_login = preg_replace('#[^A-Za-z0-9]#i', ' ', $_POST["password_login"]);

and replace them with

$user_login = strip_tags($_POST['user_login']);
$password_login = strip_tags($_POST["password_login"]);

Don't forget to hit the check mark by my answer.