PHP login with wrong password still works

Question

I've created a login page with PHP and a MySQL database. Everything works fine except when I login with the right username and wrong password it still sends me to the logged in page and doesn't keep me on the login page.

<?php
$user = $_POST['user'];
$pass = stripslashes($_POST['pass']);
$pass = mysql_real_escape_string($pass);
$pass = md5($pass);

$connect = mysql_connect("$host", "$ad_user", "$ad_pass") or die("Unable to connect to MySQL");
$db = mysql_select_db("$db", $connect) or die("Could not select examples");

$query = "SELECT * FROM members WHERE username='$user'" or die("error query");
$result = mysql_query($query);
$count = mysql_num_rows($result);
$p = mysql_fetch_array($result);
If($count == 1){
    If($p['password'] == $pass){
        session_start();
        $_SESSION['loggedin'] = 1;
        $_SESSION['username'] = $user;
        header('Location: //members.polydodo.com');
    }else{
        header('Location: ../login.php?error');
    }
}else{
    header('Location: ../login.php?error');
}

mysql_close($connect);
?>

I can't see any mistakes in this and I've double checked orders of password encryption, etc. already. Using the wrong username redirects to the error page and doesn't log me in but it logs me in with the right username regardless of the password.

PS I am aware of MySQLi and PDO but have't had time to look into that yet so I'm sticking with standard MySQL until I do.

Answer 1

problem is in below line

$query = "SELECT * FROM members WHERE username='$user'" or die("error query");
$result = mysql_query($query);

change it to

$query = "SELECT * FROM members WHERE username='$user' LIMIT 1";
$result = mysql_query($query) or die(mysql_error());

UPDATE :

also use password for authentication directly in the query like

  $query = "SELECT * FROM members WHERE username='$user' AND password='$pass' LIMIT 1";
  $result = mysql_query($query) or die(mysql_error());

Note: mysql_* is deprecated use mysqli_* or PDO

Answer 2

Use password field as well.

$query = "SELECT * FROM members WHERE username='$user' AND password='$pass'" or die("error query");
$result = mysql_query($query);
$count = mysql_num_rows($result);
//$p = mysql_fetch_array($result);
if($count == 1){
        session_start();
        $_SESSION['loggedin'] = 1;
        $_SESSION['username'] = $user;
        header('Location: //members.polydodo.com');
}else{
    header('Location: ../login.php?error');
}

Try to pass both the values in query. You dont need to match it after