Error Login

[fede-Raider]

when I try to login on my site I get error "login failed".

This is the login.php:

Line number On/Off | Expand/Contract | Select all

1. <link href="../templates/default/basic.css" rel="stylesheet" type="text/css" />
2. <form id="form1" name="form1" method="post" action="<?php $PHP_SELF; ?>">
3.   <p align="center" class="tdglobal"><span class="b01"><?php echo $config['site']['title']; ?> UserCP</span></p>
4.   <table width="200" border="0" align="center" class="liteoption">
5.     <tr>
6.       <td width="97" class="right"><div align="left">Username:</div></td>
7.       <td width="93" class="right"><input name="user" type="text" class="liteoption" id="user" size="15" maxlength="15" /></td>
8.     </tr>
9.     <tr>
10.       <td class="right"><div align="left">Password:</div></td>
11.       <td class="right"><input name="pass" type="text" class="liteoption" id="pass" size="15" maxlength="15" /></td>
12.     </tr>
13.   </table>
14.   <p align="center" class="tdglobal"><span class="right">
15.     <input name="submit" type="submit" class="liteoption" id="submit" value="Log In" size="15" maxlength="15" />
16.   </span></p>
17. </form>
18. <p align="center" class="tdglobal">
19.   <?php
20. if(isset($_POST['submit'])) {
21. $U = $_POST['user'];
22. $P = md5($_POST['pass']);
23.  
24. mysql_connect($cms['db']['host'], $cms['db']['user'], $cms['db']['pass']);
25. mysql_select_db($cms['db']['name']);
26.  
27. $result1 = "SELECT * FROM `accounts` WHERE username='$U' and password='$P' and accesslevel = '100'";
28. $query = mysql_query($result1);
29.  
30.  
31. $count = mysql_num_rows($query);
32.  
33.  
34. if($count == 1){
35.  
36. session_register("User_Name");
37. session_register("User_Pass");
38. $_SESSION['account'] = $_POST['user'];
39. echo('Logged in.... Click <a href=?op=user><strong>here</strong></a>');
40. }
41. else {
42. echo "<strong>Login Failed!</strong>";
43. }
44. }
45. ?>
46.   <br />
47. </p>
48.  

[lmame]

You access level is different from 100 perhaps?

Add some echo to see where it fails.

As a side note, your login page is screaming for hacks and mysql injection...

[fede-Raider]

Can you explain what should I do?

[lmame]

Line number On/Off | Expand/Contract | Select all

1. echo("Hey, I'm here");
2.  
3. echo("my value is ".$P);

Stuff like that...
As for protection, look for mysql_real_escape_string.

[fede-Raider]

sorry but I did not understand what I do (I know little English)

[lmame]

You put some echo command at some places to see variables values.

[PurpleYouko]

isn't it fun debugging php?

problem is you have to be sure where these variables are going to get echo'd
Sometimes they appear in some very strange places if you have any kind of complex layout.

[lmame]

Yep that's why it's better to "surround" data with some markups so you can find it easily in html output