Log in with email or user name

I'd like to ask if I have a linked fields called e-mail and Passwrod.

$email = $_POST['email'];$password = $_POST['password'];$login     = mysql_query("SELECT * FROM `users`JOIN `users_profile` USING (id)WHERE `email` = '".$email."' AND `password` = '".$password."' OR `username` = '".$email."' AND `password` = '".$password."'

That's my sign-in language.
The user entered the email or password to login successfully:

However, if the user input username (username) and password are also eligible to log in

`username` = '".$email."' AND `password` = '".$password."'

Just the above language can only be entered into email and password login
If you enter username and password, you'll fail.
Make sure join Users_profile and use ID no problem
Where is the problem?

Reply content:

I'd like to ask if I have a linked fields called e-mail and Passwrod.

$email = $_POST['email'];$password = $_POST['password'];$login     = mysql_query("SELECT * FROM `users`JOIN `users_profile` USING (id)WHERE `email` = '".$email."' AND `password` = '".$password."' OR `username` = '".$email."' AND `password` = '".$password."'

That's my sign-in language.
The user entered the email or password to login successfully:

However, if the user input username (username) and password are also eligible to log in

`username` = '".$email."' AND `password` = '".$password."'

Just the above language can only be entered into email and password login
If you enter username and password, you'll fail.
Make sure join Users_profile and use ID no problem
Where is the problem?

Be OR careful with parentheses.

SELECT * FROM `users`JOIN `users_profile` USING (id)WHERE (`email` = '".$email."' AND `password` = '".$password."') OR (`username` = '".$email."' AND `password` = '".$password."')

However, it is not recommended to use such SQL.

You can first in the code with the regular judge of the user input is email or username, if the email is the email field query, otherwise use username field.

Reference: http://tool.oschina.net/regex#

First of all, your code is easy to inject with SQL , so please use at least mysqli and personally strongly recommend PDO.

Then, my personal idea is to assume that the front-end page of the form form has a similar input:

We use here name="login" to replace email or username , then:

$field = filter_var($_POST['login'],FILTER_VALIDATE_EMAIL) ? 'email':'username';// 这里的 $field 就是你的 欄位 （这边翻译为 字段 ）

Then the SQL statement is probably like this:

$email = $_POST['email'];WHERE `".$field."` = '".$email."'

Once again, it's dangerous to say that.

Data reference: Http://php.net/manual/en/func ...

