MySQLi Login User allowing login with blank fields! :(

We've set up and installed the MySQLi Log in User behaviour on the following page:
http://www.stranraermusictown.org.uk/smtadmin/index.php

We were using an e-mail address and password to log in, to test, and it worked fine so we didn't think any more of it.
Today however I happening to click on the Sign In button without entering any information and, to my horror, it logged us straight in!
I've double checked the behaviour and nothing seems out of place. Hope you can resolve this swiftly for us. Page attached.

Thank you
NJ

My first guess would be a blank record in the users table.

Does the registration form use validation?

Both the registration and login page should have server side validation in place to prevent submitting a blank email address or password.

to troubleshoot further than that, I'll need to troubleshoot directly, see the private message section.

Blank record...thanks Jason.
Have set Server Validation to prevent that happening again.
Much appreciated.
NJ

you're welcome.

Hi Jason,
I am having the same problem, only worse.
You can log in with a blank username and password, but you can also use a username and password that isn't in the database and it will still log you in.
Is there a bug in this MySQLi user authentication module?
I have attached the page for you to look at.

In the filter tab of the UI you should be filtering the username column with the value from the form... and you shouldn't have a recordset on the page at all.

You have a recordset returning the user information and then you are logging in with the field from that recordset, which of course is always valid since it is coming from the database directly.

Delete the recordset from the page.

Update the Authenticate Server behavior and on the filter tab filter the authenticate based on both the username and password columns, getting their values from the submitted form.

Thanks Ray,
That worked. It's fine now.
As I was new to MySQLi I used Kate Ford's Tutorial to set this up, and if you read it it tells you to set up a recordset and then select your username etc from that, (see the section marked "General Tab" and the illustration that goes with it), I think it should be amended.
Anyway, thanks once again for your (very) quick help.