Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.
if ($row[password] == '$password')
This line is wrong, I'm surprised it didn't throw an error. Indexes to associative arrays are strings so it needs quotes. Using single quotes around $password will evaluate the right side to the string $password and not what $password is equal to.
Use...
I just noticed an even more glaring error
if ($user = $row['username'] AND $pass = $row['password'])
I assume you meant to use == for comparison and not = for assignment. Using === for typed comparison would be even better. Your current code will return true for any username and pass.
In mysql, all strings should be enclosed in single or double quotes. Username and password in the code above are strings, so they must have quotes around them.
In php, single quotes doesn't evaluate any variables. Double quotes will parse and evaluate variables in the string. I've read...
You are inserting the strings 'prod_name', 'qty', and 'item_desc' instead of what is contained in those variables. It should be '$prod_name', '$qty', '$item_desc'.
Like I said before, if a query isn't working the way you think it does or if it is throwing an error, print out the query string...
There are a few things wrong with that query. I'm assuming the $prod_name is a string which needs to be wrapped in single quotes. There is also an extra single quote after $item desc. When I said echo the query string, I meant echo what you were passing into the mysql_query function. For...
It's probably better to keep the sql statement in a variable for 2 reasons. It's easier to print out the statements when you are debugging and you'll have to start doing it when you build more complex queries ie. adding or removing conditionals based on how the user inputs data.
Your time...
Don't include directly from a GET variable, that's a big security risk. A safer method is to have the GET variable hold a name of the page you want to load, then use a switch statement or a series of if statements to load the correct filename.
for example:
switch( $_GET["id"] ) {
case...
No, == and === are two different comparison operators.
http://us3.php.net/operators.comparison
0 == '0' will evaluate to true
0 === '0' will evaluate to false
Are the other text on that computer enlarged as well? The DPI settings might have been changed if they are. Check under Display Properties -> Settings -> click advanced -> General.
PHP doesnt use + for string concatenations anywhere, it is always the . syntax.
The reason that the conditional was always evaluating to true in your original code is because ($firstname + " " + $lastname) evaluates to integer 0. The interpreter makes a best guess and typecasts $firstname...
One possible solution is to take in the name of the link as a paramter to the function
<script type="text/javascript">
var links = new Array("home", "login", "register", "booklist", "deletebook", "displaybooks");
function showlink(linkname) {
//set all to hidden first
for (var...