[Zafire1410]

I make a register system in mysql, now i need create the /login command but i dont know how to take the "password" from the mysql for use in the pwn

[JaTochNietDan]

You can do it in the query.

pawn Code:

format(query,sizeof(query),"SELECT Whatever FROM `table` WHERE Username = "%s" AND Password = "%s",name,params);
mysql_query(query);
mysql_store_result();
if(mysql_num_rows() > 0)
{
  //Login success
}
else
{
  //Login failed
}

[MenaceX^]

JaTochNietDan answered already.


By the way JaTochNietDan are you sure it's possible to do in a mysql query "table"?

[Joe Staff]

Shouldn't it be "SELECT * FROM mytable WHERE ..." ? I've made my own MySQL login system before and I think that doing "SELECT Whatever" would select a column called 'Whatever' whereas the '*' is all columns. You could also do "SELECT Username,Password FROM mytable ..." and that would get you the columns you're looking for anyway.

[Zafire1410]

I use that code thx but every time y try to login said "incorrect password" i cant login here is my code

pawn Code:

if(!strcmp(cmdtext, "/login", true, 3)) // 3 is the length of /me
  {
    if(cmdtext[9] == 0) {
      SendClientMessage(playerid, COLOR_GREY, "Utiliza: /login [password]");
      return 1;
    }
    else
    {
    if(logueado == 1)
    {
      SendClientMessage(playerid, COLOR_YELLOW, "Ya estas logueado");
    }
        else
        {
          new name[128];
          new query[128];
            new password = cmdtext[7];
        GetPlayerName(playerid, name, sizeof(name));
            format(query, sizeof(query), "SELECT id FROM `players` WHERE Nombre = '%s' AND Password = '%s'" , name, password);
            samp_mysql_query(query);
            samp_mysql_store_result();
            if(samp_mysql_num_rows() > 0)
            {
              logueado = 1;
          SendClientMessage(playerid, COLOR_GREEN, "Login Correcto. Bienvenido");
            }
            else
            {
              if(intentos == 3)
              {
                SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                SendClientMessage(playerid, COLOR_YELLOW, "Limites de intentos por contraseсa. Has sido Kickeado.");
                SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                    Kick(playerid);
              }
              else
              {
                intentos = intentos +1;
                SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
                SendClientMessage(playerid, COLOR_YELLOW, "Contraseсa incorrecta.");
                SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
              }
            }
        }
        }
    return 1;
  }

[Zafire1410]

Please help with my code

[JaTochNietDan]

Quote:

Originally Posted by Joe Staff Shouldn't it be "SELECT * FROM mytable WHERE ..." ? I've made my own MySQL login system before and I think that doing "SELECT Whatever" would select a column called 'Whatever' whereas the '*' is all columns. You could also do "SELECT Username,Password FROM mytable ..." and that would get you the columns you're looking for anyway.

Why would you use SELECT *? He doesn't need to retrieve every single column in the entire row just for logging someone in. Also, it was an example, I don't know what columns he has.

Zafire are you using any type of encryption on the passwords?

EDIT: I just noticed this..

pawn Code:

if(!strcmp(cmdtext, "/login", true, 3)) // 3 is the length of /me

3 may be the length of /me but it's not the length of /login

[Zafire1410]

Quote:

Originally Posted by JaTochNietDan Quote: Originally Posted by Joe Staff Shouldn't it be "SELECT * FROM mytable WHERE ..." ? I've made my own MySQL login system before and I think that doing "SELECT Whatever" would select a column called 'Whatever' whereas the '*' is all columns. You could also do "SELECT Username,Password FROM mytable ..." and that would get you the columns you're looking for anyway. Why would you use SELECT *? He doesn't need to retrieve every single column in the entire row just for logging someone in. Also, it was an example, I don't know what columns he has. Zafire are you using any type of encryption on the passwords? EDIT: I just noticed this.. pawn Code: if(!strcmp(cmdtext, "/login", true, 3)) // 3 is the length of /me 3 may be the length of /me but it's not the length of /login

Thx but that doesnt matters because my register works!! , but i change that, the problem the code you give me is usefull for "check if the player is registered" but the problem there, i need a code take "password" from the table "players" when "nombre" = %s ... and check if (sqldate) == (password used in /login)

I dont use encriptation of password

[JaTochNietDan]

The example I gave you will check if the password = the string used in /login.

EDIT: if you don't use any encryption then I don't see whats wrong other than your params aren't specified properly

[Zafire1410]

Quote:

Originally Posted by JaTochNietDan The example I gave you will check if the password = the string used in /login.

jaja yes yes sorry, let me fix that and try again

[Zafire1410]

now when i use /login my server crash after 5 secs :S

Here is my code

pawn Код:

if(!strcmp(cmdtext, "/login", true, 6))
    {
    if(cmdtext[9] == 0)
        {
      SendClientMessage(playerid, COLOR_GREY, "Utiliza: /login [password]");
      return 1;
    }
    else
    {
        if(logueado == 1)
        {
        SendClientMessage(playerid, COLOR_YELLOW, "Ya estas logueado");
        }
            else
            {
            new name[128];
            new query[128];
            new pass = cmdtext[7];
            GetPlayerName(playerid, name, sizeof(name));
                format(query, sizeof(query),"SELECT Whatever FROM `table` WHERE Username = '%s' AND Password = '%s'", name, pass);
                samp_mysql_query(query);
                samp_mysql_store_result();
                if(samp_mysql_num_rows() > 0)
                {
                logueado = 1;
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                SendClientMessage(playerid, COLOR_YELLOW, "Has sido logueado correctamente.");
                SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                }
                else
                {
                if(intentos == 3)
                {
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                    SendClientMessage(playerid, COLOR_YELLOW, "Limites de intentos por contraseсa. Has sido Kickeado.");
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                        Kick(playerid);
                }
                else
                {
                    intentos = intentos +1;
                    SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
                    SendClientMessage(playerid, COLOR_YELLOW, "Contraseсa incorrecta.");
                    SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
                }
                }
            }
        }
    return 1;
  }

[MenaceX^]

Quote:

Originally Posted by JaTochNietDan Quote: Originally Posted by Joe Staff Shouldn't it be "SELECT * FROM mytable WHERE ..." ? I've made my own MySQL login system before and I think that doing "SELECT Whatever" would select a column called 'Whatever' whereas the '*' is all columns. You could also do "SELECT Username,Password FROM mytable ..." and that would get you the columns you're looking for anyway. Why would you use SELECT *? He doesn't need to retrieve every single column in the entire row just for logging someone in. Also, it was an example, I don't know what columns he has. Zafire are you using any type of encryption on the passwords? EDIT: I just noticed this.. pawn Код: if(!strcmp(cmdtext, "/login", true, 3)) // 3 is the length of /me 3 may be the length of /me but it's not the length of /login

Hehe this was funny, I just came back and looked again on that thread and realized.
SELECT * FROM means to select everything 1 after 1, a whole row. So there's no need to that.



Eh checked your code again..

Quote:

format(query, sizeof(query),"SELECT Whatever FROM `table` WHERE Username = '%s' AND Password = '%s'", name, pass); samp_mysql_query(query); samp_mysql_store_result();

wtf?

[JaTochNietDan]

Zafire you need to specify your own columns and table, I made an example...I don't have access to your script

[Zafire1410]

Thx i the problem was there in "whatever" and "table" and "username" XD!! but now the problem is i use the correct password in /login but keep "incorrect password = contraseсa incorrecta" that :S:S

My NEW code

pawn Код:

if(!strcmp(cmdtext, "/login", true, 6))
    {
    if(cmdtext[9] == 0)
        {
      SendClientMessage(playerid, COLOR_GREY, "Utiliza: /login [password]");
      return 1;
    }
    else
    {
        if(logueado == 1)
        {
        SendClientMessage(playerid, COLOR_YELLOW, "Ya estas logueado");
        }
            else
            {
            new name[128];
            new query[128];
            new pass = cmdtext[7];
            GetPlayerName(playerid, name, sizeof(name));
                format(query, sizeof(query),"SELECT id FROM players WHERE Nombre = '%s' AND Password = '%s'", name, pass);
                samp_mysql_query(query);
                samp_mysql_store_result();
                if(samp_mysql_num_rows() > 0)
                {
                logueado = 1;
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                SendClientMessage(playerid, COLOR_YELLOW, "Has sido logueado correctamente.");
                SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                }
                else
                {
                if(intentos == 3)
                {
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                    SendClientMessage(playerid, COLOR_YELLOW, "Limites de intentos por contraseсa. Has sido Kickeado.");
                    SendClientMessage(playerid, COLOR_GREEN, "________________________________________________________");
                        Kick(playerid);
                }
                else
                {
                    intentos = intentos +1;
                    SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
                    SendClientMessage(playerid, COLOR_YELLOW, "Contraseсa incorrecta.");
                    SendClientMessage(playerid, COLOR_GREEN, "_________________________________________");
                }
                }
            }
        }
    return 1;
  }

My database is "NFS" my table is "PLAYERS" and my rows are "nombre for NAME" and "password for pass"...

[JaTochNietDan]

Use

pawn Код:

print(pass);

Then look at what it prints in your server_log or console window, just to make sure its getting the correct parameters.

[MenaceX^]

Quote:

Originally Posted by JaTochNietDan Use pawn Код: print(pass); Then look at what it prints in your server_log or console window, just to make sure its getting the correct parameters.

Or try to print the query.

[JaTochNietDan]

Ok fail? Alex just pointed out to me that you're "pass" is not a string...

It should be new pass[20] = cmdtext[7];

Anyway since that's a guarenteed fix, you also need to use mysql_escape_string(pass,pass); before setting the query string, so that you escape any injection vulnerabilities.

[Zafire1410]

print dont works for vars! i use

pawn Код:

format(pass2, sizeof(pass2),"%s", pass);
                SendClientMessage(playerid, COLOR_YELLOW, pass2);

The problem is there

only print "L" the pass i type wass "lehnaop141"

[Zafire1410]

Quote:

Originally Posted by JaTochNietDan Ok fail? Alex just pointed out to me that you're "pass" is not a string... It should be new pass[20] = cmdtext[7]; Anyway since that's a guarenteed fix, you also need to use mysql_escape_string(pass,pass); before setting the query string, so that you escape any injection vulnerabilities.

when i use that code on var "pass" give me this error when i compile

Код:

C:\Documents and Settings\Administrador\Mis documentos\Samp Server\gamemodes\nfs.pwn(475) : error 008: must be a constant expression; assumed zero

[MenaceX^]

Quote:

Originally Posted by ssǝן‾ʎ When you get your code working DO NOT type this, you'll loose the database: Код: /login '; DROP TABLE players;

Yea, this actualy what will happen if he does /login '`''`'`'' or something like that..
By the way, you could use samp_mysql_get_field to get it simply instead of doing the query.

pawn Код:

samp_mysql_get_field("The_password_in_your_language",pass);