<?php
include("mysql-info"); //includes mysql connection info

if ($HTTP_POST_VARS[user]) { //make sure they entered a username
$a = TRUE;
} else {
$a = FALSE;
$message = "Please enter a username.";
$m = urlencode($message);
header("Location: template.php?page=login&message=$m");
exit;
}

if ($HTTP_POST_VARS[pass]) { //make sure they entered a password
$b = TRUE;
} else {
$b = FALSE;
$message = "Please enter a password.";
$m = urlencode($message);
header("Location: template.php?page=login&message=$m");
exit;
}

if ($a && $b) {
$query = "SELECT * FROM `staff_users` WHERE username='$HTTP_POST_VARS[user]' AND password='password($HTTP_POST_VARS[pass])'";
$results = mysql_query($query);
$login = mysql_fetch_array($results);

if($login) {
session_start();

$username = $login[username];
$email = $login[email];
$first_name = $login[first_name];
$last_name = $login[last_name];

session_register(username);
session_register(email);
session_register(first_name);
session_register(last_name);

header("Location: template.php?page=main");
}
else {
$message = "<br>&nbsp;There has been an error, please contact ________.<br>
&nbsp;<a href=mailto:__________>__________.com</a><br>
&nbsp;<a href=aim:goim?screenname=_______s&message=Error_Discovered>________</a>";
$m = urlencode($message);
header("Location: template.php?page=login&message=$m");
exit;
}
}


?>


I don't exactly get any errors with this script, but if you notice, in the last conditional, it always goes to the else section.

This page is called after someone types in a username & password, and it's supposed to validate that, but my problem is that, it freaks out when it reaches the

$login = mysql_fetch_array($results);

line. Because of that, it always takes the else part of the last conditional.

Any help? Please?

> if ($HTTP_POST_VARS[user]) {

correct would be:

if (!empty($HTTP_POST_VARS['user'])) {

> username='$HTTP_POST_VARS[user]' AND password='password($HTTP_POST_VARS[pass])'"

should be:

password=password('$HTTP_POST_VARS[pass])')

Oh, thank you so much! The problem as the password=password('$HTTP_POST_VARS[pass]').

I put the ' in the wrong spot.