Simple PHP login form with MYSQL

[system]

Hey guys, great forum here and ive picked up on so much knowledge from reading! So im making a simple php login script where the username/password is kept on a mysql database. Everythings okay except for an error im getting that keeps saying: Parse error: syntax error, unexpected T_VARIABLE in C:\wamp\www\Assignment\index.php on line 12 im wanting it to login to the mysql and see if the user name and password match and then hopefully show the next page. The code is below:[php] <?php
if (isset($_POST[“submitted”])) {

		include_once('db_connect.php');
		include_once('cookie.php');
		$username = $_REQUEST["username"];
			$password = $_REQUEST["password"];

			if (isset($_POST['username']) && isset($_POST['password'])) {
			
			
			$query ="SELECT * FROM user WHERE user_id="$username" and
			password="$password"";
			$result=mysql_query($sql);

			$count=mysql_num_rows($result);

						if($count==1){
						//$_SESSION['name'];
						$_SESSION['user_id']=$row['user_id'];
						header ("Location: mainPage.php");
						}else 
						print "error";
			}else{
			print "You must enter details";

}
}
?>
	
<form action = "index.php">
<div>
Username: <input type="text" name="username" 
size = "20"/><br/>
Password: <input type="password" name = "password" size="20"/> <br/>
<input type = "Submit"/>
<input type="hidden" name="submitted" value="TRUE" />
</div>
</form>[/php]

Just wondering if anyone has any ideas on what the problem may be? Ive been stuck for hours and cant get to the bottom of it
thanks

[m11]

[php]$query =“SELECT * FROM user WHERE user_id=”$username" and password="$password"";[/php]

This is invalid syntax. The general rule is to use double quotes if your string contains single quotes or vice versa. It’s not required but it is required to escape double quotes inside double quotes. e.g.

Using single quotes inside double quotes (prevents the need to escape)

[php]$query =“SELECT * FROM user WHERE user_id=’$username’ and password=’$password’”;[/php]

Using double quotes inside double quotes (requires escaping)

[php]$query =“SELECT * FROM user WHERE user_id=”$username" and password="$password"";[/php]

Ideally you never want to escape strings because that makes it harder to read.

Here’s some links for you.

PHP string formatting: http://php.net/manual/en/language.types.string.php
PEAR coding standards: http://pear.php.net/manual/en/standards.php