Login-authentication To A Remote Mysql Database

I have this line of code here. My java code: btnLogin.setOnClickListener(new View.OnClickListener() { @Override $public void onClick(View v) { ArrayList<

Solution 1:

It looks like the error is in the PHP code.

Change the following line:-

From:

$query = mysql_query("SELECT * FROM user WHERE username = '$un' AND password = '$pw'");

To:

$query = "SELECT * FROM user WHERE username = '$un' AND password = '$pw'";

You should also consider making changes to prevent SQL Injection:-

$query = sprintf("SELECT * FROM user WHERE username = 
    WHERE username='%s' AND password='%s'",
    mysql_real_escape_string($un),
    mysql_real_escape_string($pw));

Solution 2:

In the code you are doing mysql_query(mysql_query()) I believe.

First try:

txtError.setText(res);

By the way: SQL injection. If you enter as password:

' UNION SELECT * FROM user WHERE username='admin

Solution 3:

Change your PHP to 'select count(*)' and check for the actual numeric value of the result. This way you aren't trying to compare against a possible NULL which can throw off line counts.

Also check your PHP separately to make sure you're getting the correct response from the ECHO.

Be aware that your android code will block until it gets a result. You should probably recode it in a thread. Otherwise the device will throw 'non responsive' and exit if SQL is too slow.

EDIT: add some code - slightly different in that it checks for whether or not a specific value is set rather than whether anything was returned. Same idea, a few more lines of code.

/** Authenticate a login.
 *
 * @param string $Username
 * @param string $Password
 * @return int
 */functionlogin($Username, $Password)
{
    Logger::DEBUG( "Login attempt by '" . $Username . "'");

    try
    {
        $conn = DBConnection::_getConsole2DB();

        $query = "select LoginId, UserId, RoleId, ProjectMask, RestrictionMask from Users where LoginId = ? and Password = ? and Active = 1";
        $st = $conn->prepare( $query );
        $st->bindParam( 1, $Username );
        $st->bindParam( 2, $Password );
        $st->execute();

        $row = $st->fetch( PDO::FETCH_ASSOC );
                    if( !isset( $row[ 'UserId' ])) return0;

        $this->userId = $row[ 'UserId' ];
        $this->roleId = $row[ 'RoleId' ];
        $this->projectMask = $row[ 'ProjectMask' ];
        $this->restrictionMask = $row[ 'RestrictionMask' ];         

        $_SESSION[ 'userId' ] = $this->userId;
        $_SESSION[ 'roleId' ] = $this->roleId;
        $_SESSION[ 'projectMask' ] = $this->projectMask;
        $_SESSION[ 'restrictionMask' ] = $this->restrictionMask;
        $_SESSION[ 'loginId' ] = $row[ 'LoginId' ];

    }
    catch( PDOException $e )
    {
        Logger::PDO_ERROR( $e );
        return -1; // error
    }

    return1; 
}

This uses PDO so there are some small syntax differences with what you're trying.