Login-signon script is not working....what could be the reason

Question

I am attaching the relvant portion of the script which is not working. login.php calls this script logincheck.php
I have created a table and passed values into the table (in oracle). However echo shows no values being passed.
<?
$v1 = $_REQUEST[user_id];
$v2 = $_REQUEST[auth_id];
//$v3 = $_REQUEST[brcd];
// Checking in ORACLE database USerID, Passwd & Branch Code Combination
include 'ConnDB8i.Php';
//echo 'Passed values'.$v1.$v2.$v3;
if(!$dbconnect)
     echo "<br><br><br><br><table width=300 align=center border=1><td >Database is Not available...!<br>Try after sometime.</td></table>";
     echo "<input type='hidden' name='conn' value='NO'>";
return;
// Connecting to ORACLE 8i
$mSql = "Select user_name,auth_id,branch_cd,user_lock,user_type from scfu_users where user_id='".$v1."'";
echo "<br>'paased values'.$mSql";
$stmt = OCIParse($dbconnect,$mSql);
OCIExecute($stmt);
$nRows = OCIFetchStatement($stmt,$result);
echo "<br>'passed values'.$nRows";
if($nRows==0)
     echo "<Br><font size=5>Invalid User Id</font>";
     OCIFreeStatement($stmt);
     OCILogoff($dbconnect);
     return;
reset($result);
$colcnt = 0;
$i=0;
$nRows reurns 0...... why?
$mSql is correct. It returns values as expected.
The error I am getting is invalid User ID.Obviously $nRows is 0 when it should not be so.
Any suggestions/answers please??
JJZ

Answer 1

A couple of things I noticed:
Add error handling and check the return value from the OCIExecute() call.
Use bind variables in the WHERE clause to avoid SQL injection issues.
Use the most recent version of PHP and the oci8 extension that is
compatibile with your version of Oracle. (Or get the free version of
the Oracle DB from http://www.oracle.com/technology/products/database/xe/index.html )
-- cj