Re: Perl and Mysql display data problem

Others have replied about your syntax problem but you've got
other problems you don't know yet.

 > my $sth = $dbh->prepare(qq{
 >    select uid, password from logins
 >         where username = $input_username
 > });

The username field is not quoted (see DBI docs for quote method) but
better still use parameters:

$sql = q/select uid,password from logins where username = ?/;
$sth->prepare($sql);
$sth->execute($input_username);

or you will be susceptible to sql injection.

Also, since you know the username and password, why read the password
and test it - why not let the database do it:

select uid from logins where username = ? and password = ?

Lastly, your fetchrow array to populate @matix is virtually
the builtin method fetchall_arrayref.

Martin

FoRo wrote:
> Hello I have several problems. I'm trying to write a perl script that would
> check the username and password from Mysql database and allow users to
> login. I'm new to both systems and i have a lot of oruble with them. Here is
> the perl script that i'm trying to build.
> -----------------------------------------------------------------------------------------------------
> 
> #!/usr/bin/perl -wT
> 
> use strict;
> use CGI;
> use CGI::Carp;
> use DBI;
> use Template;
> 
> 
> # Load the CGI input data.
> my $html = new CGI;
> print $html->header();
> 
> #my $dsn = 'DBI:mysql:ttf:localhost';
> #my $db_user_name = 'web';
> #my $db_password = 'nouser';
> #my ($uid, $password);
> #my $dbh = DBI->connect($dsn, $db_user_name, $db_password);
> 
> 
> my ($sth);
> 
> 
> my ($input_username = "bobob", $input_password = "password") 
> 
> 
> my $sth = $dbh->prepare(qq{
>    select uid, password from logins
>         where username = $input_username
> });
> $sth->execute();
> 
> ($uid, $password) = $sth->fetchrow_array();
> $sth->finish(): 
> if ($input_password eq $password) 
> {
>           ...
> }
> 
> $sth->fetchrow_array()
> 
> my $sth = $dbh->prepare(qq{
>    select fname, lname from users
> });
> $sth->execute();
> while (my ($fname, lname) = 
>   $sth->fetchrow_array())
> {
>      print "$fname, $lname\n";
> }
> $sth->finish();
>  
> 
> my (@matrix) = ();
> while (my @ary = $sth->fetchrow_array())
> {
>    push(@matrix, [@ary]);
> }
> sth->finish();
> 
> 
> $dbh->disconnect();
> 
> -----------------------------------------------------------------------------------------------------
> 
> I keep on getting this errors, i have idea how to fix them. :)
> 
> -----------------------------------------------------------------------------------------------------
> 
> syntax error at ./login.pl line 34, near ")
> 
> 
> my "
> Global symbol "$input_username" requires explicit package name at ./login.pl
> line 34.
> Global symbol "$uid" requires explicit package name at ./login.pl line 40.
> syntax error at ./login.pl line 41, near "):"
> Execution of ./login.pl aborted due to compilation errors.
> 
> -----------------------------------------------------------------------------------------------------
> 
> 
> Any help would be really apreciated.
> 
> Another question i have, how to write the code so it could get for example
> first name and last name. and put them in to a hashed array, so i could
> display only fthe first or last name on the page.
> 
> Once again, thx guys.
> 
> --
> View this message in context: http://www.nabble.com/Perl-and-Mysql-display-data-problem-t1842429.html#a5029478
> Sent from the MySQL - Perl forum at Nabble.com.
> 
> 


-- 
MySQL Perl Mailing List
For list archives: http://lists.mysql.com/perl
To unsubscribe:    http://lists.mysql.com/[email protected]