6 replies to this topic

[mutago]

Hi experts, am trying to login from a webpage but when i run this code,
it returns an error, any help please

#!C:/Ruby095/bin/ruby 

require 'cgi'


cgi = CGI.new

puts cgi.header


require "mysql"




begin

    con = Mysql.new 'localhost', 'root', 'root33', 'db'


    rs = con.query("SELECT * FROM account where username=%s %(username) and password = %s %(password)")

    

    rs.each do |row|

       



 if username == row[0] and password == row[1]:


puts 'login'

else

puts 'no'

end


    end

         

rescue Mysql::Error => e

    puts e.errno

    puts e.error

    

ensure

    con.close if con

end

[WingedPanther]

What's the error?

[mutago]

okay, in the database, i have
username = mutago and password = mutanx22.
when i used sql query by referencing the username and password in this code below,

 rs = con.query("SELECT * FROM account where username='mutago' and password ='mutax22'")

the applications runs perfectly and only the right user are authenticated
okay now i want to authenticate the users access from web page and i have to look for a parameter symbol
that will be used to repalce username and password variables so that the right user will be authenticate so i set this

 rs = con.query("SELECT * FROM account where username=%s %(username) and password = %s %(password)")

This query authenticates both the wrong and right users. I think my problems lines in using wrong parameter symbols in the SQL where CLAUSE statement

  where username=%s %(username) and password = %s %(password)")

[/code}


In php,  it works this way

[code] ("SELECT * FROM account where username=$username and password = $password")

 

and php parameter symbol is $

any help please

[WingedPanther]

Try this one:

("SELECT * FROM account where username='$username' and password = '$password'")

[mutago]

I think that $ is used for php and am running ruby CGI. I think the answer is close to something like this though i have tried it but it does not work OUT

    rs = con.query("SELECT * from user_log where username = %s and password =%s") % (username,password)

because to print value from database in ruby, i used %s parameter symbols,
thanks for your response and am still counting on you

[WingedPanther]

As I've said before, I'm not a ruby programmer, but I would expect you to need to quote the parameters. I could certainly be wrong.

[mutago]

okay, thanks