I have an error in the SQL syntax that says

Question

1.00/5 (1 vote)

See more:

Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'lt where uname= '' and password=''' at line 1 in F:\New folder\htdocs\login\login.php:20 Stack trace: #0 F:\New folder\htdocs\login\login.php(20): mysqli_query(Object(mysqli), 'select * lt whe...') #1 {main} thrown in

What I have tried:

<?php

if($_POST)
{
   $host="localhost";
   $user="root";
   $password="";
   $database="logintest";
   $connection=mysqli_connect($host,$user,$password,$database);


   
// include ('connection.php');
$user=$_POST['uname'];
$pass=$_POST['pasw'];

$query="select * lt where uname= '$user' and password='$pass'";

$result=mysqli_query($connection, $query);

$Nrows=mysqli_num_rows($result);
if($Nrows==1)
{  session_start();
while($Nrows=mysqli_fetch_assoc($result))
{
    $_SESSION['user']=$Nrows['uname'];
    $_SESSION['pass']=$Nrows['password'];
    $_SESSION['rol']=$Nrows['rol'];
}

header("location:index.php");

}
else
{
    echo 'wrong user name or password';
}
?>



<?php
 if($_POST)
 {
    $host="localhost";
    $user="root";
    $password="";
    $database="logintest";

 }

}
?>



<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Document</title>
</head>
<body>
  <form action="login.php" method="POST"> 
<input type="text" name="uname" id="un">
<label for="un">user name</label>
<br>
<br>
<input type="password" name="pasw">
<label for="pasw">password</label>

<input type="submit">


</form> 
</body>
</html>

Posted 1-Dec-22 8:14am

moljsy tsms

Updated 1-Dec-22 8:21am

v2

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard MacCutchan · Accepted Answer · 2022-12-01T08:21:00

You missed out the FROM keyword between the "*" and the table name. But you have more important problems to fix. You are storing your passwords in clear text, which is a very serious security error. You are also using string concatenation to build your SQL which leaves you open to destruction of your database by SQL Injection (Google it). You should always use proper hashing of passwords, and parameterised queries for SQL.