It wont execute the econd if part even though all variables are right?

199

May 27, 2017, at 7:09 PM

I have to programm a website using php and HTML for school i created a script that should be used as log in. the problem it never executes the second if part. It works with the first when you log in as admin. however when you log in as student with name, first name and pin it only executes the last if part which redirects you to the log in again.

script

<html>
<body>
<?php
mysql_connect("","root");
mysql_select_db("projekt");
$PinOG = "SELECT PIN FROM log_in WHERE Name =" . $_POST["Name"] . " and 
NName =" . $_POST["NName"];
$NameOG = "SELECT Name FROM log_in WHERE NName =" . $_POST["NName"] . " and 
PIN =" . $_POST["Pin"];
$NNameOG = "SELECT NName FROM log_in WHERE Name =" . $_POST["Name"] . " and 
PIN =" . $_POST["Pin"];
$resN = mysql_query($NameOG);
$numN = mysql_num_rows($resN);
if ($_POST["Name"] == "Admin" and  $_POST["NName"] == "Admin" and 
$_POST["Pin"] == 1337){
    header("Location:http://localhost/Projekt/Dalkner.html");
    exit();
}
if ($_POST["Name"] == $NameOG and $_POST["NName"] == $_NNameOG and 
$_POST["Pin"] == $PinOG){
    $localtime = localtime();
    $localtime_assoc = localtime(time(), true);
    if ($localtime["6"] == 0 or $localtime["6"] == 6 or $localtime["6"] == 
1){
        $Day = "Montag";}
    if ($localtime["6"] == 2){
        $Day = "Dienstag";}
    if ($localtime["6"] == 3){
        $Day = "Mittwoch";}
    if ($localtime["6"] == 4){
        $Day = "Donnerstag";}
    if ($localtime["6"] == 3){
        $Day = "Freitag";}
    $Week = strftime("%V");
    if ($Week % 2){
        $SP = "spgm";
        $SPO = "spg";
        $RP = "rpgm";
        $RPO = "rpg";
    } else {
        $SP = "spum";
        $SPO = "spu";
        $RP = "rpum";
        $RPO = "rpu";
    }
    $commandEX = "mysqldump -u -p " .$SPO. "_" .$NameOG. "_" .$NNameOG > 
$SP. "_" .$NameOG. "_" .$NNameOG.".sql";
    exec($commandEX);
    $commandIM = "mysql -u -p " .$SP. "_" .$NameOG. "_" .$NNameOG < $SP. "_" 
.$NameOG. "_" .$NNameOG.".sql";
    exec($commandIM);
    $Kurs = "SELECT Kurs FROM Lehrerf, kurse WHERE Lehrer = Lehrerf";
    $resK = mysql_query($Kurs);
    $numK = mysql_num_rows($resK);
    if ($numK != 0){
        mysql_query("UPDATE" .$SP."_".$NameOG."_".$NNameOG . " Set NULL 
WHERE " . $Day . " = " . $Kurs);
    }
    $commandREX = "mysqldump -u -p " .$RPO. "_" .$NameOG. "_" .$NNameOG > 
$RP. "_" .$NameOG. "_" .$NNameOG.".sql";
    exec($commandREX);
    $commandRIM = "mysql -u -p " .$RP. "_" .$NameOG. "_" .$NNameOG < $RP. 
"_" .$NameOG. "_" .$NNameOG.".sql";
    exec($commandRIM);
    $RLength = "SELECT RaumNeu FROM RaumÄ";
    $resL = mysql_query($RLength);
    $numL = mysql_num_rows($resL);
    if ( $NumL != 0){
        while ( $numL != 0){
            $RaumNeu = "SELECT RaumNeu FROM RaumÄ WHERE idx = " . $numL;
            $RaumAlt = "SELECT RaumAlt FROM RaumÄ WHERE idx = " . $numL;
            if (mysql_num_rows($RaumNeu) === 0){
                $numL = $numL - 1;
            }else{
                $RaumN = "SELECT RaumNeu FROM RaumÄ WHERE idx = " . $numL;
                $RaumA = "SELECT RaumAlt FROM RaumÄ WHERE idx = " . $numL;
                mysql_query("UPDATE" .$Rp."_".$NameOG."_".$NNameOG . " Set " 
. $Day . " = " . $RaumN . " WHERE " . $Day . " = " .$RaumA);
                $numL = $numL - 1;
            }
        }
    }
    $Vplan = "Select" . $Day . ", Stunden FROM " . $SP. "_" .$NameOG. "_" 
.$NNameOG . " ORDER BY stunden DESC";
    echo "<P>" . $Vplan . "</P>";
    $VplanR = "Select" . $Day .  " FROM " . $RP. "_" .$NameOG. "_" .$NNameOG 
. " ORDER BY stunden DESC";
    echo "<PR>" . $VplanR . "</PR>";
}
if ( $numN == 0 ){
    header("Location:http://localhost/Projekt/Log_in.html") ;
    exit();
}
?>
</body>
</html>

I really dont know why it does not execute the second part. However i can guaranteee that the variables typed into log in and the database match perfectly.

Answer 1

It's a lot of code you've posted. Two things are visible to me.

Here's one. Your redirect to the login page at the end of your program depends ONLY on getting a zero-row result set at the beginning of your program. In order for this result set to have a nonzero number of rows, both NName and PIN must match. I can't tell from your logic whether that's the correct behavior.

$NameOG = "SELECT Name FROM log_in WHERE NName =" . $_POST["NName"] . " and PIN =" . $_POST["Pin"];
...
$resN = mysql_query($NameOG);
$numN = mysql_num_rows($resN);
...
if ( $numN == 0 ){
    header("Location:http://localhost/Projekt/Log_in.html") ;
    exit();
}

Here's another.

if ($_POST["Name"] == $NameOG and $_POST["NName"] == $_NNameOG and $_POST["Pin"] == $PinOG){
  ...

I can't see where $_NNameOG is defined. I can see where $NameOG and $PinOG are defined. They are text strings containing SELECT queries. So the == tests will never come up true. So this code appears incorrect.