login.php sql数据库

Question

I am getting this error when my login.php file loads.. 'Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource' Heres what i have..

$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrows = mysql_num_rows($query);
if($numrows!=0)
{
while ($row = mysql_fetch_assoc($query))
{
    $dbusername = $row['username'];
    $dbpassword = $row['password'];
}
if ($username==$dbusername&&$password==$dbpassword)
{
    echo "Youre in!";
}
else
    echo "Incorrect Password!";
}
else
    die("That user doesnt exist!");
}
else
die("Please enter a username and a password!");
?>

Answer 1

Add this to the top of the your file

ini_set('display_errors', 'on');
error_reporting(E_ALL | E_STRICT);

This "should" show your syntax errors, in any case, your issue is syntax errors

The code below should get you a little closer to your final destination

<?
ini_set('display_errors', 'on');
error_reporting(E_ALL | E_STRICT);

if($username) {
    $query = mysql_query("SELECT * FROM users WHERE username='$username'");
    $numrows = mysql_num_rows($query);
    if($numrows!=0) {
        while ($row = mysql_fetch_assoc($query)) {
            $dbusername = $row['username'];
            $dbpassword = $row['password'];
        }

        if ($username==$dbusername&&$password==$dbpassword) {
            echo "Youre in!";
        } else {
            echo "Incorrect Password!";
        }
    } else {
        die("That user doesnt exist!");
    }
} else {
    die("Please enter a username and a password!");
}

Answer 2

You missed some curly brackets:

$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrows = mysql_num_rows($query);
if($numrows!=0)
{
    while ($row = mysql_fetch_assoc($query))
    {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
    }
    if ($username==$dbusername&&$password==$dbpassword)
    {
        echo "Youre in!";
    }
    else
        echo "Incorrect Password!";
    }
} else // <- THIS ONE
    die("That user doesnt exist!");
}
// And here another, in a if condition that isn't started in the code you give.
else
die("Please enter a username and a password!");
?>

The server could be configured that if an error shows up, the page is left blank.

Some other tips for mySQL login: Never ever put an user input directly in a MySQL query statement! It is then very easy to hack your site by means of SQL injection.

For more details: http://www.derby-web-design-agency.co.uk/blog-post/how-to-create-a-secure-login-system-in-php-part-1/12/