?error= de error? & meer

ik ben bezig met een systeempje
ik heb nu dat als er iets fout gaat je naar login.php?error=er is iets fout gegaan
gaat
en nu heb ik op de site staan
dat werkt dus niet hoe moet het wel?

maar t is niet echt (lees: echt niet..) veilig hea.

wat is dan niet veilig?

PS:

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in C:xampphtdocspagelogin.php on line 8

code van login.php:

[COLOR= #0000BB]<?[/COLOR]
[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_SERVER[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]REQUEST_METHOD[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #DD0000]"POST"[/COLOR][COLOR= #007700]){[/COLOR]

[COLOR= #0000BB]$user[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]user[/COLOR][COLOR= #007700]];[/COLOR]
[COLOR= #0000BB]$pass[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]];[/COLOR]

[COLOR= #0000BB]$query[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * FROM users WHERE username = $user AND pass = $pass"[/COLOR][COLOR= #007700]);[/COLOR]
[COLOR= #0000BB]$result[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_num_rows"]mysql_num_rows[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$query[/COLOR][COLOR= #007700]);[/COLOR]

[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$result[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/while"]while[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$object[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_object"]mysql_fetch_object[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$query[/COLOR][COLOR= #007700])){[/COLOR]
[COLOR= #0000BB]$memberid[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]id[COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$active[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$object[/COLOR][COLOR= #007700]->[/COLOR]active[COLOR= #007700];
}[/COLOR]
[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$active[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"<meta http-equiv="refresh" content="0;URL=login.php?error=er is iets fout gegaan">"[/COLOR][COLOR= #007700];[/COLOR]
[URL="http://www.php.net/exit"]exit[/URL][COLOR= #007700];
}[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$active[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #DD0000]"yes"[/COLOR][COLOR= #007700]){[/COLOR]
[COLOR= #0000BB]$_SESSION[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]memberid[/COLOR][COLOR= #007700]] =[/COLOR] [COLOR= #0000BB]$memberid[/COLOR][COLOR= #007700];[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"<meta http-equiv="refresh" content="0;URL=user.php">"[/COLOR][COLOR= #007700];[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"<br><br>Inloggen..."[/COLOR][COLOR= #007700];
}
}}[/COLOR]
?>
    </p>
    <form name="form1" method="post" action=""> Gebruikersnaam:<br>
  <input name="user" type="text" id="user" value="">
  <br>
  Wachtwoord:<br>
  <input name="pass" type="password" id="pass">
  <br>
  <input type="submit" name="Submit" value="Inloggen &gt;&gt;">
<br>
<b>[COLOR= #0000BB]<?[/COLOR] [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #0000BB]$_GET[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]error[/COLOR][COLOR= #007700]];[/COLOR] ?></b>
</form>            
            <br />                    
                                            
        </div>

Connecten naar DB?

gedaan

doe eens op regel 8:

$query = mysql_query("SELECT * FROM users WHERE username = $user AND pass = $pass") or die(mysql_error());

en post de error

Sjoerd schreef:

doe eens op regel 8:

$query = mysql_query("SELECT * FROM users WHERE username = $user AND pass = $pass") or die(mysql_error());

en post de error

sorry zlef gefixt
REGISTREREN KAPOT!

edit: kan iemand er voor zorgen dat je vanzelf geactiveert word
de mail word niet verstuurt en je word gelijk geactiveert
inplaats van 0 yes:

Hier kun je je aanmelden op Verdien-Scripts.nl.<br />
      Aanmelden is helemaal gratis, en de download ook.
      [COLOR= #0000BB]<?[/COLOR]
[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_SERVER[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]REQUEST_METHOD[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #DD0000]"POST"[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"<br><br>"[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$user[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_GET[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]ref[/COLOR][COLOR= #007700]];[/COLOR]
[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]user[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Geen username ingevuld!"[/COLOR][COLOR= #007700];
}[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Geen wachtwoord ingevuld!"[/COLOR][COLOR= #007700];
}[/COLOR][URL="http://www.php.net/elseif"]elseif[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]email[/COLOR][COLOR= #007700]] ==[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700]){[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Geen emailadres ingevuld!"[/COLOR][COLOR= #007700];
}[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
[COLOR= #0000BB]$result[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"select * from users where username=$_POST[user]"[/COLOR][COLOR= #007700]);[/COLOR]
[URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$row[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_Array"]mysql_fetch_Array[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$result[/COLOR][COLOR= #007700])) {[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]"Gebruikersnaam is in gebruik, kies een andere!"[/COLOR][COLOR= #007700];
}[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
[COLOR= #0000BB]$code[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/md5"]md5[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]]);[/COLOR]
[COLOR= #0000BB]$userreg[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]user[/COLOR][COLOR= #007700]];[/COLOR]
[URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"INSERT INTO users (id, username, email, saldo, pass, button, active, code, ip) VALUES (NULL, $_POST[user], $_POST[email], 10, $_POST[pass], , 0, $code, "[/COLOR][COLOR= #007700].[/COLOR][COLOR= #0000BB]$_SERVER[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]REMOTE_ADDR[/COLOR][COLOR= #007700]].[/COLOR][COLOR= #DD0000]")"[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/print"]print[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR]
[COLOR= #0000BB]$van[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #DD0000]"$webmaster_email"[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$to[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]email[/COLOR][COLOR= #007700]];[/COLOR]
[COLOR= #0000BB]$ow[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #DD0000]"Account activeren"[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$inh[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #DD0000]"Hallo.nJe hebt je aangemeld op $sitenaam.nnKlik op onderstaande link om je account te activeren:n$siteurl"[/COLOR][COLOR= #007700].[/COLOR][COLOR= #DD0000]"activeer.php?code=$code&user=$userreg"[/COLOR][COLOR= #007700];[/COLOR]
[COLOR= #0000BB]$success[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mail"]mail[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$to[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$ow[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #0000BB]$inh[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #DD0000]"From: <$van>"[/COLOR][COLOR= #007700]);[/COLOR]
[COLOR= #0000BB]$query[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"UPDATE `users` SET saldo=saldo+$refextra WHERE `username` = $user"[/COLOR][COLOR= #007700]);[/COLOR]
[URL="http://www.php.net/echo"]echo[/URL][COLOR= #DD0000]"Succesvol aangemeld!<br>Controleer je email voor de activatielink."[/COLOR][COLOR= #007700];
}}}[/COLOR][URL="http://www.php.net/else"]else[/URL][COLOR= #007700]{[/COLOR]
?>
    </p>
    <form name="form1" method="post" action="">
  <font size="2" face="Verdana, Arial, Helvetica, sans-serif"> Gebruikersnaam:<br>
  <input name="user" type="text" id="user">
  <br>
  Wachtwoord:<br>
  <input name="pass" type="password" id="pass">
  <br>
  Emailadres:<br>
  <input name="email" type="text" id="email">
  <br>
  <input type="submit" name="Submit" value="Aanmelden &gt;&gt;">
  </font> 
</form>
[COLOR= #0000BB]<?[/COLOR]
[COLOR= #007700]}[/COLOR]
?>

regel 20:

mysql_query("INSERT INTO users (id, username, email, saldo, pass, button, active, code, ip) VALUES (NULL, $_POST[user], $_POST[email], 10, $_POST[pass], , yes, yes, ".$_SERVER[REMOTE_ADDR].")") or print(mysql_error());

ok