登錄腳本無法正常工作，無法匹配用戶名和密碼

Question

我已經編寫了一個簡單的登錄腳本，但是它不匹配用數據庫輸入從表單中檢索的用戶名和密碼。

下面是代碼：

<?php 

// Include database connection settings 
include $_SERVER["DOCUMENT_ROOT"] . 'system/db/DbConnection.php'; 

// Inialize session 
session_start(); 

// Retrieve POST variables from login form 
$username = mysql_real_escape_string($_POST['username']); 
$password = mysql_real_escape_string($_POST['password']); 

// Retrieve username and password from database according to user's input 
$qLogin = mysql_query("SELECT * FROM users WHERE username = '{$username}'") or die("MySQL ERROR: ".mysql_error()); 
$rLogin = mysql_fetch_array($qLogin); 
echo '1<BR />'; 

echo $password . '<BR />'; 
echo $rLogin['password'] . '<BR />'; 
echo '2<BR />'; 

echo $username . '<BR />'; 
echo $rLogin['username'] .'<BR />'; 
echo '3<BR />'; 

// Check username and password match 
if ($username == $rLogin['username'] && $password == $rLogin['password']) { 
    echo '4<BR />'; 
    // If last_login and login_ip == "", its the users first time loging in 
    if($rLogin['last_login'] == "" && $rLogin['login_ip'] == ""){ 
    echo '5<BR />'; 
    // The date right now 
    $date = date("d/m/y H:i:s"); 
    // Get user IP 
    $ip = $_SERVER['REMOTE_ADDR']; 
    // Update last_login and login_ip 
    echo '6<BR />'; 
    mysql_query("UPDATE users SET last_login = '{$date}', login_ip = '{$ip}' WHERE username = '{$username}'") or die("MySQL ERROR: ".mysql_error()); 
    } 

    // Set session variables 
    $_SESSION['username'] = $username; 
    $_SESSION['auth'] = $rLogin['auth']; 

    //header("Location: ../success/"); 
    //exit(); 
    echo '7<BR />'; 
} else { 
    // Jump to login page 
    //header("Location: ../"); 
    //exit(); 
    echo '8<BR />'; 
} 
?> 

我得到如下回應：1,2,3和8。我也感到我已經包含回聲的用​​戶名和密碼，以及他們所有的比賽..

PS：沒有必要評論不安全的密碼，密碼是高度加密的，密碼是相等的，當我回聲他們，所以這也不是問題。

Answer 1

$username = mysql_real_escape_string($_POST['username']); 
$password = mysql_real_escape_string($_POST['password']); 

// Retrieve username and password from database according to user's input 
$qLogin = mysql_query("SELECT * FROM users WHERE username = '$username' ANd password='$password'") or die("could not fetch"); 
if (mysql_num_rows($qLogin) > 0) { 
    $rLogin = mysql_fetch_assoc($qLogin); 
    echo '1<BR />'; 

    // put your all success page link 
} else { 
    //put login page. 
}