last day (20 days later) » 

8:20 AM
welcome and thank you for help\
 
sure I will make it better just tied up for a few minutes
 
8:56 AM
<?php
session_start();
include('configdb.php');
if(isset($_POST['submit']))
{
$email = trim($_POST['email']);
$password = trim($_POST['password']);
$query = "SELECT * FROM member WHERE email='$email' AND password='$password' AND com_code IS NULL";
$result = mysqli_query($mysqli,$query)or die(mysqli_error());
$num_row = mysqli_num_rows($result);
$row=mysqli_fetch_array($result);
if( $num_row ==1 )
{
$_SESSION['user_name']=$row['username'];
header("Location: member.php");
exit;
}
else
{
echo 'false';
Drew plz if you have time check this error
@Drew
 
@RebeccaJoanna where is $mysqli coming from? It is not in scope unless brought in from the include
 
@Drew i included configdb.php check the first line
done
 
9:13 AM
you would have to agree that you appear to be mixing mysql and mysqli
cuz we saw that in your code you had in your question
 
hahaha yes
i am doing same mistake again and again
 
the next step is to do prepared statements with bindings so people don't sql injectthe db
 
yeah i know little about that
@Drew is there aany Good tutorial for Database
or site
 
stackoverflow has great stuff
what are you struggling with?
Look what I have here for register.php and login.php. Note how any user supplied data is using bind param type of calls to cleanse out sql injection attacks. Ya can't just concat the strings. It is not safe
"ss" would mean 2 strings coming in. "si" is string and number
$stmt->bind_param("ss", $email,$hp);
 
10:12 AM
great and thanks
 

  last day (20 days later) »