Have you ever heard of indenting your code?

Anyway, the first problem is the !=, which does a numeric comparison; you most likely want to do a string comparison with ne. The second problem is that you are obviously trying to compare an array (which has a @ sigil) with a scalar value (which has a $ sigil). That cannot work.

Edit: Regarding your edit of the question: Could you try to write sentences? Concise and clear language makes you a better programmer. It also helps others understand what you want to say. They can then, in turn, better help you with your problems.

Let's ignore for a moment the strange use of "select *" when what you really want is two specific columns and the seemingly unnecessary usage of grep...

In that world, you could do something along the lines of:

#!C:\strawberry\perl\bin\perl.exe
use dbi;
use strict;
use warnings;

my $usernameentered = "user89";
my $passwordentered = "password12";

my $dbh = DBI->connect('dbi:mysql:Database','username','password')
    or die "Connection Error: $DBI::errstr\n";

my $sql = "select * from usertable";
my $sth = $dbh->prepare($sql);
$sth->execute
    or die "SQL Error: $DBI::errstr\n";

while (my @row = $sth->fetchrow_array) {
    my @username= grep /$usernameentered/, @row;
    print "@username\n";
    my @password= grep /$passwordentered/, @row;
    print "@password\n";

    #if (@username !=$usernameentered)
    if ($username[0] ne $usernameentered)#??which index??
    {
        print "incorrect username entered **$username[0]**\n";
    }

    #if (@password !=$passwordentered)
    if ($password[0] ne $passwordentered)#??which index??
    {
        print "incorrect password entered $password[0]**\n";
    }
}
[download]

Now, back in the real world, why not just let the database do the work for you?

#!C:\strawberry\perl\bin\perl.exe
use dbi;
use strict;
use warnings;

my $usernameentered = "user89";
my $passwordentered = "password12";

my $dbh = DBI->connect('dbi:mysql:Database','username','password')
    or die "Connection Error: $DBI::errstr\n";

my $sql = "select user from usertable where user = ? and pwd = ?";
my $sth = $dbh->prepare($sql)
    or die "SQL Error: $DBI::errstr\n";
$sth->execute($usernameentered, $passwordentered)
    or die "SQL Error: $DBI::errstr\n";

while (my @row = $sth->fetchrow_array) {
    #do whatever you want with this user
}
[download]

The last thing that jumps out is that you are evidently storing pwds in the database in clear text. That's a no-no, unless you really don't care about the passwords, in which case why use them in the first place? But, perhaps this is not your decision. If it is, you should use one of the many one-way hash modules on cpan to create a hash of the password and then store THAT, rather than storing the password itself.

hi with the 'let the database work for you' example....how would I get it so users define the username and password as its meant to be a login type script? also im ignoring the login issues i.e. access to passwords till the end. Thanks for your help so far! bogglemaster89

How would I get it so users define the username and password as its meant to be a login type script?

You ask for user input, whether reading from the STDIN, taking command-line arguments, or reading a file with login credentials.

You'll have to request their input, presumably via STDIN. You'll also want to look at Term::ReadKey so that their passwords aren't printed to the screen when typed.

If you say "invalid username", then someone can keep throwing usernames with don't-care passwords at the site until they hit a valid one. Then they can start guessing passwords, knowing that they already have a username.

If you use email addresses for usernames, it gets even worse: you have made social engineering of the target user simpler, as the bad person simply needs to try to finagle a known email address into giving away their password (or being phished).

If you just say "invalid user ID or password", then you've given the "I can't log you in because you don't have both of these right" information, but you've not allowed random probing to transmit any information, even if by chance one of the two is right.

@username = grep /^$usernameentered$/, @row;

Will give you a list of all the columns containing only $usernameentered (note the ^ and $).


unless (@username) {
    print "incorrect username entered @username\n";
}
[download]

Perhaps the best solution would be to replace the wildcard in the query with a named list, starting with username and password. Then, you could avoid grep altogether and just match the array elements directly. Or, you could keep the wildcard and fetchrow_hashref, and use the column names to find the info you need.

if (@username !=$usernameentered)
{
print "incorrect username entered @username\n";
}
[download]

if (@password !=$passwordentered)
{
print "incorrect password entered @password\n";
}
[download]