Error in php if, login authentication system

Question

Hello, then, I’m trying to make a simple login system with php and mysql, but it’s giving error in my if. I’ve moved... too much and nothing, when it seems right it does not authenticate you put any password q or login name and go. This is my code:

<?php 
$login = $_POST['nomel'];
 $senha = $_POST['senha'];


 include 'conexao.php';

 $busca = mysql_query("SELECT * from usuario where nm_login = '$login'");

 $reg = mysql_fetch_assoc($busca);

 if 
    ($login == $reg ['nm_login']) && ($senha == $reg ['nm_senha']) {
    # code...
    header("location: test.html");
 }
 else{
    echo "<center><b>Login Incorreto!</center>";
 }
 ?>

And this is the error message:

Parse error: syntax error, Unexpected '&' (T_BOOLEAN_AND) in E: IMPORTANT Usbwebserver V8.6 root NK authenticationLogin.php on line 13*

Answer 1

There were some parentheses missing from if that has in the code, this:

if ($login == $reg ['nm_login']) && ($senha == $reg ['nm_senha']) {

Has a parenthesis for each comparison of if but there is not one that covers all the comparison.

See a simplified example of the Ideone error

You can do it like this:

if (($login == $reg ['nm_login']) && ($senha == $reg ['nm_senha'])) {
//-^--------------------------------------------------------------^

Or simplify and use only one parenthesis for the if whole:

if ($login == $reg ['nm_login'] && $senha == $reg ['nm_senha']) {

---

I strongly advise updating database functions to mysqli since mysql versions have been discontinued and no longer exist since php version 7.

You should also consider handling the input received in $login and $senha or use Prepared statements, because as has the code at the moment is susceptible to attacks from mysql Injection

Answer 2

I believe that the code is more for didactic purposes, if as the colleague above said, he is facing attacks not only of SQL Injection. But for comparison, use the SQL search already returning only the user who has LOGIN AND PASSWORD already validated.

$busca = mysql_query("SELECT * from usuario where nm_login = '$login' and nm_senha='$senha'");

then just check if the query returned any results or empty....