登录脚本无法正常工作，无法匹配用户名和密码

Question

我已经编写了一个简单的登录脚本，但是它不匹配用数据库输入从表单中检索的用户名和密码。

下面是代码：

<?php 

// Include database connection settings 
include $_SERVER["DOCUMENT_ROOT"] . 'system/db/DbConnection.php'; 

// Inialize session 
session_start(); 

// Retrieve POST variables from login form 
$username = mysql_real_escape_string($_POST['username']); 
$password = mysql_real_escape_string($_POST['password']); 

// Retrieve username and password from database according to user's input 
$qLogin = mysql_query("SELECT * FROM users WHERE username = '{$username}'") or die("MySQL ERROR: ".mysql_error()); 
$rLogin = mysql_fetch_array($qLogin); 
echo '1<BR />'; 

echo $password . '<BR />'; 
echo $rLogin['password'] . '<BR />'; 
echo '2<BR />'; 

echo $username . '<BR />'; 
echo $rLogin['username'] .'<BR />'; 
echo '3<BR />'; 

// Check username and password match 
if ($username == $rLogin['username'] && $password == $rLogin['password']) { 
    echo '4<BR />'; 
    // If last_login and login_ip == "", its the users first time loging in 
    if($rLogin['last_login'] == "" && $rLogin['login_ip'] == ""){ 
    echo '5<BR />'; 
    // The date right now 
    $date = date("d/m/y H:i:s"); 
    // Get user IP 
    $ip = $_SERVER['REMOTE_ADDR']; 
    // Update last_login and login_ip 
    echo '6<BR />'; 
    mysql_query("UPDATE users SET last_login = '{$date}', login_ip = '{$ip}' WHERE username = '{$username}'") or die("MySQL ERROR: ".mysql_error()); 
    } 

    // Set session variables 
    $_SESSION['username'] = $username; 
    $_SESSION['auth'] = $rLogin['auth']; 

    //header("Location: ../success/"); 
    //exit(); 
    echo '7<BR />'; 
} else { 
    // Jump to login page 
    //header("Location: ../"); 
    //exit(); 
    echo '8<BR />'; 
} 
?> 

我得到如下回应：1,2,3和8。我也感到我已经包含回声的用​​户名和密码，以及他们所有的比赛..

PS：没有必要评论不安全的密码，密码是高度加密的，密码是相等的，当我回声他们，所以这也不是问题。

Answer 1

$username = mysql_real_escape_string($_POST['username']); 
$password = mysql_real_escape_string($_POST['password']); 

// Retrieve username and password from database according to user's input 
$qLogin = mysql_query("SELECT * FROM users WHERE username = '$username' ANd password='$password'") or die("could not fetch"); 
if (mysql_num_rows($qLogin) > 0) { 
    $rLogin = mysql_fetch_assoc($qLogin); 
    echo '1<BR />'; 

    // put your all success page link 
} else { 
    //put login page. 
}