[NeilHanlon]

Your problem is that you're using mysql_.

Other than that, UPDATE just uses commas. isLoggedIn = 'yes', currentIp = "$ip"

EDIT: Oh. and someone entering '"; DROP TABLE Login;

would seriously mess up your day.

[arronhunt]

I'm not too good with PHP, but I believe your variables are just being read as strings. So whenever you have a variable in quotes you should do {$variable}.

Someone correct me if I'm wrong

[Cyril]

arronhunt, on 06 November 2011 - 02:20 PM, said:

I'm not too good with PHP, but I believe your variables are just being read as strings. So whenever you have a variable in quotes you should do {$variable}.

Someone correct me if I'm wrong

You're wrong
With double quotes, variables are parsed

[TheUnknown]

Thanks it works now

[arronhunt]

cyrilmengin, on 06 November 2011 - 02:23 PM, said:

You're wrong
With double quotes, variables are parsed

Holy cats are you for real? My life just became easier.

[NeilHanlon]

Lol yep Aaron.

"$var" prints the value of $var,

'$var' prints well.. "$var"

and '' . $var prints the value of $var

[Imjoshholloway]

TheUnknown, on 06 November 2011 - 03:38 PM, said:

Thanks it works now

Just to clarify it was the AND that was the problem.

You can also optimize your code a bit more by doing the following:

$getdata = mysql_query("SELECT id, username, password FROM Login WHERE username='$username' WHERE rank != 'Banned' LIMIT 1");
     
// no point running if no results
if ($getdata)
{
    $data = mysql_fetch_array($getdata);
          
    // does the user password match
    if ($hashed==$data['password'])
    {
        $id = $data['id'];
        
        echo "Welcome to the website!";
        echo "<a href=/game.php>Go to game.</a>";

        // update the ip
        mysql_query("UPDATE Login SET isLoggedIn = 'Yes', currentIp = '$ip' WHERE id = '$id' ");
    }
}
else
{
    echo "INVALID LOGIN CREDENTIALS. Please try again.";
}

I'd also suggest looking at: Using PDO

(If you don't want to use PDO. Make sure you're escaping stuff using mysql_escape_real_string() before running queries etc.)

and the following for Storing IP's