please i need help to with the code of the one below. am trying to create a login page the select username from one table and select password from another table but am confused now please help me with correct code of the on below



<?
include("connect.php";
$tbl_name1="student"; // Table name
$tbl_name2="pin_generate"; // Table name

$registration_number=$_POST['registration_number']; // username sent from form
$pin=$_POST['pin']; // pin sent from form


// To protect MySQL injection
$registration_number = stripslashes($registration_number);
$pin = stripslashes($pin);
$registration_number = mysql_real_escape_string($registration_number);
$pin = mysql_real_escape_string($pin);

//Query
$sql="SELECT registration_number pin FROM $tbl_name1, $tbl_name2 WHERE registration_number='$registration_number' and pin='$pin'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row


while ($row = mysql_fetch_assoc($result)) {
if ($row['count'] == '0') {
header('location: user1.html'); //User1
session_register("registration_number";
session_register("pin";

}
else
if ($row['count'] == '1') {
header('location: user2.html'); //User2
$_SESSION['login_user'] = $registration_number;
session_register("registration_number";
session_register("pin";
echo "<script>alert('Access Denied!');
.location='index.php';
</script>";
}
}


//Direct pages with different user levels


?>

I think I understand you.

You've stored usernames in one table and password in another table.

But wait

The logic is like this...I enter a room and tell them my name. I leave the room and go to the password room to tell them my password.

Now, for password to work well, the username and password should ideally be in a table ie in different rows. So if username is valid, the corresponding password row is checked.

But

In your case, if username is valid in one row...you then go to another table...what of if I just put someone else's password? Would I be authenticated?

I suggest you keep them in a table. It goes against some ideal data structure principles sef.

But anyway, one must'nt do the ideal, so if its possible and secure, guys would soon let you know.

###
But wait oo, who's the most active female programmer here on Nairaland ? Any female prog. Sef?
###


Sincerely, badthinds

You want to do Mysql Join? Else i dont think it would be reasonable to have it this way. What exactly are u trying to implement? One time password? if yes you can use rand() to generate password and have it mailed to you, then create a formal algorithm to check if the password matches then you authenticate.

How about if you use the Student ID as the username and password stored in one table. .and then when the person enters his pin, it will automatically register the PIN for that student id and increase the pin count by 1. the login condition should easily check for a valid pin if it already exists in the student login and keep incrementing it until it gets to maybe 5. Then it can inform the user on successive logins that the pin has expired.