DaniWeb Forum Index > Web Development > PHP

please tell me what is wrong with the code

Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases

•

Join Date: Oct 2006

Posts: 90

Reputation: dami06 is an unknown quantity at this point

Solved Threads: 0

dami06

Offline

Junior Poster in Training

please tell me what is wrong with the code

Feb 4th, 2008

I'm trying to create a simple login page by following a tutorial i saw online. I did everything it required but i got this error

// Check if session is not registered , redirect back to main page. // Put this code in first line of web page.
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\test\login_success.php:3) in C:\xampp\htdocs\test\login_success.php on line 4
Login Successful

this is my code.

checklogin.php

 Help with Code Tags 
 PHP Syntax (Toggle Plain Text) 
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password="emilyking"; // Mysql password
$db_name="test"; // Database name
$tbl_name="members"; // Table name
 
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
 
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
 
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
 
if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
 
ob_end_flush();
?>
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password="emilyking"; // Mysql password
$db_name="test"; // Database name
$tbl_name="members"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}

ob_end_flush();
?>

login_success.php

 Help with Code Tags 
 PHP Syntax (Toggle Plain Text) 
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>
 
<html>
<body>
Login Successful
</body>
</html>
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>

<html>
<body>
Login Successful
</body>
</html>

is there a problem somewhere??

Last edited by MattEvans; Feb 4th, 2008 at 9:07 am. Reason: Please use [code] tags around large blocks of code.

•

Join Date: Nov 2007

Posts: 3,747

Reputation: nav33n is a jewel in the rough

Solved Threads: 331

nav33n

Offline

Senior Poster

Re: please tell me what is wrong with the code

Feb 4th, 2008

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>
 
<html>
<body>
Login Successful
</body>
</html>
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>

<html>
<body>
Login Successful
</body>
</html>

Do you have the comments outside the <? tag ?

Ignorance is definitely not bliss!

*PM asking for help will be ignored*

•

Join Date: Oct 2006

Posts: 90

Reputation: dami06 is an unknown quantity at this point

Solved Threads: 0

dami06

Offline

Junior Poster in Training

Re: please tell me what is wrong with the code

Feb 4th, 2008

yes that's what i saw in thhe website that i got this information from. I was testing it on my laptop to see if it would work so as to create my own but instead i got that message

•

Originally Posted by nav33n

Help with Code Tags

php Syntax (Toggle Plain Text)
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>
 
<html>
<body>
Login Successful
</body>
</html>
// Check if session is not registered , redirect back to main page. // Put this code in first line of web page. <? session_start(); if(!session_is_registered(myusername)){ header("location:main_login.php"); } ?> <html> <body> Login Successful </body> </html>
Do you have the comments outside the <? tag ?

•

Join Date: Nov 2007

Posts: 3,747

Reputation: nav33n is a jewel in the rough

Solved Threads: 331

nav33n

Offline

Senior Poster

Re: please tell me what is wrong with the code

Feb 4th, 2008

Remove them and put it after <? tags. Its considered as 'output' if you have it outside <? tag. And if you are using session_start or header function, nothing should be outputted before session_start or header function.

Ignorance is definitely not bliss!

*PM asking for help will be ignored*

•

Join Date: Oct 2006

Posts: 90

Reputation: dami06 is an unknown quantity at this point

Solved Threads: 0

dami06

Offline

Junior Poster in Training

Re: please tell me what is wrong with the code

Feb 4th, 2008

thanks a lot nav, that worked..ur awesome..

•

Join Date: Nov 2007

Posts: 3,747

Reputation: nav33n is a jewel in the rough

Solved Threads: 331

nav33n

Offline

Senior Poster

Re: please tell me what is wrong with the code

Feb 4th, 2008

you are welcome!

Ignorance is definitely not bliss!

*PM asking for help will be ignored*

•

Join Date: Jan 2009

Posts: 1

Reputation: demhold is an unknown quantity at this point

Solved Threads: 0

demhold

Offline

Newbie Poster

Re: please tell me what is wrong with the code

Jan 15th, 2009

## comment from reto demhold / 15th januar 2009

after i strugled with this code in its original form i altered the code
to my needs. for users of the original code, finding themself stucked i advice to replace
session_register("myusername") and use $_SESSION instead (php 4.1) or

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$HTTP_SESSION_VARS["myusername"] = "$myusername";
$HTTP_SESSION_VARS["mypassword"] = "$mypassword";
$HTTP_SESSION_VARS["myusername"] = "$myusername";
$HTTP_SESSION_VARS["mypassword"] = "$mypassword";

and call it again in login_success.php

you may also want to replace:

header("location:login_success.php");
with :
echo "<meta http-equiv=\"Refresh\" content=\"0; url= login_success.php">";

NOTE: since you relocate to a new page (login_success.php) which maybe needs a own header for
other purposes you can NOT call a header relocation which will result into an error.
so i have chosen the meta refresh. since you have registered the username and password
you can call it again with session_start(): on every page you need the username (and may compare
to the username given from the mySQL database, whatever)
as example. for those who say it is NOT save to use meta refresh it is! on the new page just call

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
session_start();
if(!session_is_registered(myusername)){
 
// your page content
 
}
session_start();
if(!session_is_registered(myusername)){

// your page content

}

for advanced user, you might also want to create a session id and store it into the table and force each page to call it from the database, comparing wit the username and password. but remember to destroy the session when logout and delete it from the database

### end of message

•

Originally Posted by dami06

I'm trying to create a simple login page by following a tutorial i saw online. I did everything it required but i got this error

// Check if session is not registered , redirect back to main page. // Put this code in first line of web page.
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\test\login_success.php:3) in C:\xampp\htdocs\test\login_success.php on line 4
Login Successful

this is my code.

checklogin.php
Help with Code Tags

PHP Syntax (Toggle Plain Text)
<?php
ob_start();
$host="localhost"; // Host name
$username="root"; // Mysql username
$password="emilyking"; // Mysql password
$db_name="test"; // Database name
$tbl_name="members"; // Table name
 
// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");
 
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
 
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
 
if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}
 
ob_end_flush();
?>
<?php ob_start(); $host="localhost"; // Host name $username="root"; // Mysql username $password="emilyking"; // Mysql password $db_name="test"; // Database name $tbl_name="members"; // Table name // Connect to server and select databse. mysql_connect("$host", "$username", "$password")or die("cannot connect"); mysql_select_db("$db_name")or die("cannot select DB"); // Define $myusername and $mypassword $myusername=$_POST['myusername']; $mypassword=$_POST['mypassword']; $sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'"; $result=mysql_query($sql); // Mysql_num_row is counting table row $count=mysql_num_rows($result); // If result matched $myusername and $mypassword, table row must be 1 row if($count==1){ // Register $myusername, $mypassword and redirect to file "login_success.php" session_register("myusername"); session_register("mypassword"); header("location:login_success.php"); } else { echo "Wrong Username or Password"; } ob_end_flush(); ?>
login_success.php
Help with Code Tags

PHP Syntax (Toggle Plain Text)
// Check if session is not registered , redirect back to main page.
// Put this code in first line of web page.
<?
session_start();
if(!session_is_registered(myusername)){
header("location:main_login.php");
}
?>
 
<html>
<body>
Login Successful
</body>
</html>
// Check if session is not registered , redirect back to main page. // Put this code in first line of web page. <? session_start(); if(!session_is_registered(myusername)){ header("location:main_login.php"); } ?> <html> <body> Login Successful </body> </html>
is there a problem somewhere??

Last edited by peter_budo; Jan 17th, 2009 at 6:07 am. Reason: Keep It Organized - For easy readability, always wrap programming code within posts in [code] (code blocks) and [icode] (inline code) tags.

•

Join Date: Aug 2008

Posts: 84

Reputation: MVied is an unknown quantity at this point

Solved Threads: 5

MVied

Offline

Junior Poster in Training

Re: please tell me what is wrong with the code

Jan 15th, 2009

Additionally, your code is very unsafe. Anyone could hack this form with MySQL injections, such as typing ' OR a=a-- in the password field. This would allow them to login to the site with the username of whoever is first in the database.

Replace this:

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";

With this:

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
// If no magic quotes, add slashes
if(!get_magic_quotes_gpc()) {
 $myusername = addslashes($_POST['myusername']);
 $mypassword = addslashes($_POST['mypassword']);
}
 
// Username and password sent from form.
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
// If no magic quotes, add slashes
if(!get_magic_quotes_gpc()) {
 $myusername = addslashes($_POST['myusername']);
 $mypassword = addslashes($_POST['mypassword']);
}

// Username and password sent from form.
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";

Last edited by MVied; Jan 15th, 2009 at 12:01 pm.

"We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true." - Robert Wilensky