PHP not sure how to compare 2 fields.

[murdocsvan]

Basically, i have a form, for creating new users on my database. It just has 3 fields; one for the username; one for the password and one to confirm the user put the right password in. Everything in the form works except comparing the two password fields to make sure they match. I've tested and tried loads of things but if they don't match they still add the user to the database anyway

This is the code for the end of the script:

if(empty($username) ||  empty($password) || empty($confirm_password))
	{
	echo "Fields are empty";
	}
else
	{
	//?????????????????????????????????????????????????//
	//???Problem comparing first and second password???//
	//?????????????????????????????????????????????????//
	if($password != $confirm_password)
		{
		echo "New passwords did not match'";
		}
	else
		{
		//Turn posted fields into sha1 values
		$password = sha1($password);
		$confirm_password = sha1($confirm_password);
		
		//Determine what the ID number will be
		$sql = "SELECT * FROM $tbl_name";
		$result = mysql_query($sql,$con);
		$num_rows = mysql_num_rows($result);
		$num_rows ++;
		
		//Enter new user into database
		$create = "INSERT INTO $tbl_name (id, username, password) 
		VALUES('$num_rows', '$username', '$password')";
		mysql_query($create,$con);
		
		//Take user to Success! page
		header("location:****.php");
		}
	}

 

[office politics]

try using strcmp() instead

PHP: strcmp - Manual

 

[kmote]

Your comparison looks fine to me. You might want to try echoing $password and $confirm_password to check that they are in fact the inputs you have given.
Couple of notes about the other parts of the code though; 1) you don't need to encrypt your $confirm_password. 2) The way you are getting your ID is dangerous. If a row is deleted from the table the row count will go down but your next ID never should (since it is not necessarily the last record that was deleted). Instead, use an autoincrementing value on the database and remove the ID from your insert statement.

EDIT: almost forgot, you should also check that the insert is successful

 

[CrazeD]

You should also be using mysql_escape_string() or mysql_real_escape_string() on ALL user input.