title: PHP 5.4 basic login script
body: <p>Trying to learn myself PHP with some database interaction and I am trying to do a "simple" (most things can be relative...) login script and when I first tried it I got a few errors about session_register which I now understand is deprecated and I tried to change it to $_SESSION['something'] = 'something';</p>
  
  <p>My database is set with a user, I can connect fine and pick the right database but when I enter the username and password I get sen back to the login form, which it should do when it fails.</p>
  
  <p>I do have something to catch wrong username or password that got casted when I used the deprecated version. I just have three filed, main_login.php, checklogin.php and login_success.php and will post them below.</p>
  
  <p>main_login.php</p>
  
  <pre><code>&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" 
  "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"&gt;
  &lt;html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en'&gt;
  &lt;head&gt;
      &lt;meta http-equiv='content-type' content='application/xhtml+xml; charset=UTF-8' /&gt;
  
      &lt;title&gt;Login&lt;/title&gt;
      &lt;!-- JAVASCRIPTS --&gt;
      &lt;script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js"&gt;&lt;/script&gt;
      &lt;script type="text/javascript" src="script/jquery.js"&gt;&lt;/script&gt;
      &lt;!-- CSS FILES --&gt;
      &lt;link rel='stylesheet' type='text/css' href='css/default.css' /&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;div id='wrapper'&gt;
          &lt;div id='loginform'&gt;
              &lt;form action="checklogin.php" method='post' id='login'&gt;
                  Username: &lt;br /&gt;
                  &lt;input type='text' name='username' /&gt;&lt;br /&gt;
                  Password: &lt;br /&gt;
                  &lt;input type='text' name='password' /&gt;&lt;br /&gt;
                  &lt;input type='submit' value='Login' /&gt;
              &lt;/form&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p></p>
  
  <p>checklogin.php</p>
  
  <pre><code>&lt;?PHP
  //Server/database settings
  ob_start();
  $host       = "localhost";
  $username   = "root";
  $password   = "";
  $db_name    = "user";
  $tbl_name   = "userdata";
  
  //Connect to the server and select the database
  mysql_connect("$host", "$username", "$password") or die ("cannot connect");
  mysql_select_db("$db_name") or die ("cannot select DB");
  
  //Get the username and password from the login form
  //Prevent SQL injections
  $username = mysql_real_escape_string($_POST['username']);
  $password = mysql_real_escape_string(md5($_POST['password']));
  $username = stripslashes($username);
  $password = stripslashes($password);
  //$username = mysql_real_escape_string($username);
  //$password = mysql_real_escape_string($password);
  $sql = "SELECT * FROM $tbl_name WHERE username = '$username'
  and password = '$password'";
  $result = mysql_query($sql);
  
  //Count the table row. 0 = No user exists
  $count = mysql_num_rows($result);
  
  //If $result is 1 the user exists
  if($count == 1) {
      $_SESSION['username'] = '$username';
      $_SESSION['password'] = '$password';
      header('location:login_success.php');
  }
  
  /*  //If the result match the $username &amp;&amp; $password, table row will be 1
  if($count == 1) {
      session_register('username');
      session_register('password');
      header('location:login_success.php');
  }*/
  
  //If it does not match, give a return message
  else {
      echo 'Wrong Username or Password';
  }
  ob_end_flush();
  ?&gt;
  </code></pre>
  
  <p>and the last login_success.php</p>
  
  <pre><code>&lt;?PHP
  session_start();
  if (!isset($_SESSION['username'])) {
      header('location:main_login.php');
  }
  ?&gt;
  &lt;html&gt;
      &lt;body&gt;
          Login Successful
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>This just throws me back to the login page :/</p>
  
  <p>Also if anyone notice any code that can be vulnerable to SQL injection, feel free to point that out and suggest what I should do instead.</p>