PHP User Login Password Error
<p>I have a problem with my login session, i am using the code posted below for more than a year, but now, a friend tried to make an account with the password = parola .
With this password he can't login.
It gives me the error "Your login session data is not on record in the database." But if i try another password.. it says that the password it's wrong, and when you enter back the password parola.. it gives me that error.</p>

<p>I checked the id.. it's correct... the email is correct and the password is correct, but i still can't login with any user with password ="parola"</p>

<p>I'm afraid that can exist other password incompatibles with my code.</p>

<p>All other password you choose the scrpit it's fine... 
Can anyone help me with some idea, where i can find the problem (i'm not so good at programming)</p>

<p>Thank YOU!</p>

<p>This is PHP code, for entering an account:</p>

<pre><code>    &lt;?php
session_start();
if(!isset($_SESSION["client_store"])){
    header("location: http://website.com/login/");
    exit();
}


// Be sure to check that this manager SESSION value is in fact in the database
$clientID = preg_replace('#[^0-9]#i', '', $_SESSION["id"]); // filter everything but numbers andletters
$client_store = preg_replace('[abc]', '', $_SESSION["client_store"]); // filter everything but numbers and letters
$password = preg_replace('[abc]', '', $_SESSION["password"]); // filter everything but numbers and letters
// Run mySQL query to be sure that this person is an admin and that their password session var equals the database information
// Connect to the MySQL database  
include "_storescripts/connect_to_mysql.php"; 
$sql = mysql_query("SELECT * FROM user_login WHERE id='$clientID' AND email='$client_store' AND password='$password' LIMIT 1"); // query the person
// ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
$existCount = mysql_num_rows($sql); // count the row nums
if ($existCount == 0) { // evaluate the count
    echo ("Your login session data is not on record in the database.");
    session_destroy();
    header('Refresh: 3; url=http://website.com');

     exit();
}
?&gt;
</code></pre>

<p>This is the code, for makeing an account:</p>

<pre><code>&lt;?php
session_start();
if (isset($_SESSION["client_store"])) {
   header("location: http://website.com/account/"); 
   exit();
}
// Parse the log in form if the user has filled it out and pressed "Log In"
if (isset($_POST["login_username"]) &amp;&amp; isset($_POST["login_password"])) {
    $client_store = preg_replace('[abc]', '', $_POST["login_username"]); // filter everything but numbers and letters
    $password = preg_replace('#[^A-Za-z0-9]#i', '', md5($_POST["login_password"])); // filter everything but numbers and letters
    // Connect to the MySQL database  
    include "_storescripts/connect_to_mysql.php"; 
    $sql = mysql_query("SELECT id FROM user_login WHERE email='$client_store' AND password='$password' LIMIT 1"); // query the person
    // ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
    $existCount = mysql_num_rows($sql);// count the row nums
    if ($existCount == 1) { // evaluate the count
         while($row = mysql_fetch_array($sql)){ 
             $id = $row["id"];
         }
         $_SESSION["id"] = $id;
         $_SESSION["client_store"] = $client_store;
         $_SESSION["password"] = $password;
         header("location: http://website.com/account/");
         exit();
    } else {
        header ("location: http://website.com/parola-eronata/");
            exit();
    }
}
?&gt;
</code></pre>

<p>Acount creation script</p>

<pre><code>&lt;?php
session_start();
if(!isset($_POST['create_username'])){
    header("location:http://website.com/login/");
    exit();
}
?&gt;
&lt;?php
include "_storescripts/connect_to_mysql.php";
// Parse the form data and add inventory item to the system
if (isset($_POST['create_username'])) {
    $new_username = mysql_real_escape_string($_POST['create_username']);
    $password_ales = mysql_real_escape_string (md5 ($_POST['create_password']));
    $password_again = mysql_real_escape_string (md5 ($_POST['verificarepassword']));
    // See if that product name is an identical match to another product in the system
    $sql = mysql_query("SELECT id FROM user_login WHERE email='$new_username' LIMIT 1");
    $userMatch = mysql_num_rows($sql); // count the output amount
    if ($userMatch &gt; 0) {
        echo 'Ne pare rau, acest email exista deja in baza de date!, &lt;a href="http://website.com/login/"&gt;Click here&lt;/a&gt;';
        exit();
    } 
    // Add the user in the Database
    $sql = mysql_query("INSERT INTO user_login (email, password)
        VALUES('$new_username','$password_ales')") or die (mysql_error());
     $pid = mysql_insert_id();
      $_SESSION["id"] = $pid;
      $_SESSION["client_store"] = $new_username;
      $_SESSION["password"] = $password_again;
      header("location: http://website.com/account.php");
      exit();
}
?&gt;
</code></pre>
