Q: Cant see what is wrong with my script, seems to work on another site PHP login script This is my attempt at a basic mysqli php login script (im only learning, so please dont be too harsh).
Can anyone see why it would be bringing up 0 rows every time and failing to login?
<?php
$con = mysqli_connect("localhost","user","pass","database");

if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL, Please contact an Administrator";
}

$username = mysqli_real_escape_string($_POST['username']);
$password = mysqli_real_escape_string($_POST['password']);  

$query = "SELECT * FROM users WHERE user_name='$username' AND pass_phrase='$password'";

$result = mysqli_query($con, $query);

$row_cnt = mysqli_num_rows($result);

if (!$row_cnt == 0) {
    echo "Usename/Password Combination Failed";
} else {
    echo "Welcome " . $_POST['username'];
    }

mysqli_close($con);
?>


A: You need to pass DB connection to mysqli_real_escape_string() as an added parameter.
What you're presently using:
$username = mysqli_real_escape_string($_POST['username']);
$password = mysqli_real_escape_string($_POST['password']);

What you should be using:
$username = mysqli_real_escape_string($con, $_POST['username']);
$password = mysqli_real_escape_string($con, $_POST['password']);

Plus, if if (!$row_cnt == 0) doesn't work after making those changes, try a reverse approach:
I.e.:
$row_cnt = mysqli_num_rows($result);

if ($row_cnt > 0) {

echo "Welcome " . $_POST['username'];

} else {
    echo "Usename/Password Combination Failed";
    }


Consider adding or die(mysqli_error($con)) to mysqli_query() to signal errors in code.

Sidenote:
I noticed you may be storing passwords in plain text. If this is the case, it is highly discouraged.
I recommed you use CRYPT_BLOWFISH or PHP 5.5's password_hash() function.
For PHP < 5.5 use the password_hash() compatibility pack. 

Footnotes:
Consider looking into using: 


*

*Prepared statements, or PDO with prepared statements, they're much safer.




A: Try removing ! or == 0 from your if condition at the bottom. Or even better:
if ($row_cnt) {
  // Welcome
} else {
  // Notify about authentication failure
}

Also, it's a good practice to hash your password/pass phrase.

A: This is very basic approach for login, assuming you have user table with id, username, and password :
<?php
 if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
    $errors = array();

    if(!$_POST['username']) //check if username has been filled
    {
        $errors[] = 'bla bla text for empty username notice';
    }
    else
    {
        $username = mysqli_real_escape_string($conn, trim($_POST['username']));
    }

    if(!$_POST['password'])//check if password has been filled
    {
        $errors[] = 'bla bla text for empty password notice';
    }
    else
    {
        $password = mysqli_real_escape_string($conn, trim($_POST['username']));
    }

    if(empty($errors)) //no errors appears
    {
        $query = "SELECT * FROM tablename WHERE user_name = '$username' AND password = SHA1('$password')";
        $result = @mysqli_query($conn, $query);

        if(mysqli_num_rows($result) == 1)
        {
            //if one database row (record) matches the input:
            // Start the session, fetch the record and insert the three values in an array
            session_start();
            $_SESSION = mysqli_fetch_array($result, MYSQLI_ASSOC);
            header("direct to after login page");
        }
        else
        {
            // No match was made
            $errors[] = 'Sorry no record match with the data you have submitted';
        }
    }
    else
    {
        // If there was a problem.
        echo mysqli_connect_error($conn);
    }
}


A: You need to fix the quoting in your query.  Right now you are trying to login as a user with user name $username and password $password and most likely no such combination exists. Also unless you are allowing two users to have the same username you should just query based on the username and then compare the hashed password provided with the stored hashed password.
