Member Avatar for doha786

i'm just very new in php & its my 1st post here.. having a small problem to pass the login error msg to LOGIN.PHP from check login page.

here is the code of checklogin.php file:

if($count==1){

// Register $myusername, $mypassword and redirect to file "welcome.php"
session_register("myusername");
session_register("mypassword");
header("location:welcome.php");
}
else {
$msg = urlencode("Invalid Login. Please try again with correct user email and password. ");
header("Location: login.php?msg=$msg");
}

And here is the login.php file where want to show the error mssg:

<?php
if (isset($GET['msg'])) {
$err = mysql_real_escape_string($_GET['msg']);
echo $err;
}
?>

Anybody help please where to change or add the code ?

  • 4 Contributors
  • 5 Replies
  • 282 Views
  • 4 Hours Discussion Span
  • Latest Post Latest Post by doha786

Dani AI

Generated

Nice that the immediate issue was resolved in the thread. Below are safer, more robust patterns and a few gotchas to help avoid the same problem in future and to harden the login flow.

Use a session "flash" message instead of putting text in the URL. This keeps messages short, avoids URL length/encoding issues and is safer for privacy. Example pattern (checklogin sets the flash; login.php shows it and unsets it):

# checklogin.php (before redirect)
session_start();
if ($count == 1) {
    $_SESSION['user'] = $myusername;
    header('Location: welcome.php');
    exit;
}
$_SESSION['flash'] = 'Invalid email or password.';
header('Location: login.php');
exit;
# login.php (display once)
session_start();
if (!empty($_SESSION['flash'])) {
    echo htmlspecialchars($_SESSION['flash'], ENT_QUOTES, 'UTF-8');
    unset($_SESSION['flash']);
}

Quick checklist and troubleshooting tips:

  • Always call session_start() before reading/writing $_SESSION and before sending output.
  • Call exit; (or die;) right after header('Location: ...') to stop further script execution.
  • Escape any user-supplied text when echoing (htmlspecialchars) to prevent XSS. Do not use database-escaping functions (like mysql_real_escape_string) for HTML output.
  • Move away from the old mysql_* API — use mysqli or PDO with prepared statements, and use password_hash() / password_verify() for passwords.
  • Avoid verbose error details on login pages; show a generic message to reduce information leakage.

Credit to , and for the quick debugging help. The pattern above will make the flow cleaner and more secure going forward.

Recommended Answers

All 5 Replies

Member Avatar for rajengg

Check below code:

<?php
if ($GET['msg']!="") {
$err = urldecode($_GET['msg']);
echo $err;
}
?>
Member Avatar for doha786

Thanks for your reply.. i had tried above code too but no ouput. Its passing the msg but not showing. (Not found any error also)

Member Avatar for daniel36

change get variable in header

    if($count==1){
    // Register $myusername, $mypassword and redirect to file "welcome.php"
    session_register("myusername");
    session_register("mypassword");
    header("location:welcome.php");
    }
    else {
    $msg = urlencode("Invalid Login. Please try again with correct user email and password. ");
    header("Location: login.php?error=1");
    }

And your login.php

<?php
if (isset($GET['error'])) {
if($_get['error']==1)
{
echo "Invalid Login. Please try again with correct user email and password.";
}
}
?>
Member Avatar for adam.adamski.96155

The problem is with the $_GET['error'] variable - in one place it is $_GET in the next palce it is $GET without the underscore. You need the underscore in both instances, $GET is not the same as $_GET. Also you can send the message via the URL (the get method), but as Daniel shows the message can be given on the login page as presumably there is only one error message and therefore no need to carry it from one page to another?

Member Avatar for doha786

Really thanks Adam... the problem was in $GET without the underscore & its working now.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.