Member Avatar for Indians

this is my login page coding. my login form html coding and php coding is in same page. now if login successful it will redirect to mainpage.php and then if login failure it will show the error message on same page (login.php). how to do that? i tried something but its not working... how to use php session here?

<?php
    if($_SERVER['REQUEST_METHOD'] == 'POST')
    {
    $uname = $_POST['username'];
    $pwd = $_POST['password'];
    $uname = htmlspecialchars($uname);
    $pwd = htmlspecialchars($pwd);

    $user = "root";
    $pass = "";
    $database = "data";
    $link = mysql_connect( "localhost", $user, $pass );
    if(!$link)
    {
        die ( "Could not connect to MySQL : " .mysql_error() );
    }
    mysql_select_db ($database, $link) or die ( "Could not select MySQL $database : " .mysql_error() );
    $result = mysql_query( "SELECT * FROM emp_register WHERE emp_username = '$uname' AND emp_password = '$pwd'" );
    while($row = mysql_fetch_array($result))
    {
    if($row["emp_username"] == $uname && $row["emp_password"] == $pwd)
    {
    echo "Welcome $uname";
    }
    else
    {
    echo "Username and Password does not match";
    }
    }
    }
?>
Edited by Indians
  • 4 Contributors
  • 3 Replies
  • 11K Views
  • 2 Hours Discussion Span
  • Latest Post Latest Post by minitauros

Dani AI

Generated

A few fixes will make this login flow reliable and secure:

  • Do not echo anything before sending a redirect header. Call header('Location: ...'); and then exit;.
  • Avoid mysql_* and plain-text passwords. Use prepared statements and password_hash/password_verify. Query by username, fetch one row, then verify the password. On success, regenerate the session ID and redirect; on failure, set an error message and re-render the same page.

Example pattern you can drop at the top of your login.php (before any HTML):

<?php
session_start();

$error = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $pdo = new PDO('mysql:host=localhost;dbname=data;charset=utf8mb4', 'root', '', [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    ]);

    $stmt = $pdo->prepare('SELECT id, emp_username, emp_password_hash FROM emp_register WHERE emp_username = ? LIMIT 1');
    $stmt->execute([$_POST['username']]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($user && password_verify($_POST['password'], $user['emp_password_hash'])) {
        session_regenerate_id(true);
        $_SESSION['user_id'] = (int)$user['id'];
        $_SESSION['username'] = $user['emp_username'];
        header('Location: mainpage.php');
        exit;
    }

    $error = 'Invalid username or password.';
}
?>

In your HTML, conditionally show <?= htmlspecialchars($error) ?> where you want the message. Hash new passwords at registration with password_hash (docs) and verify with password_verify (docs). For secure queries, see PDO prepared statements (docs). Regenerating the session ID reduces fixation risk (docs).

Recommended Answers

All 3 Replies

Member Avatar for minitauros

As both posters above are saying, you can use a header to redirect the user to another page. Example:

if($row["emp_username"] == $uname && $row["emp_password"] == $pwd)
{
    // Set the header that will redirect the user to the given page
    // when this page's PHP script is done loading.
    header('Location: mainpage.php');

    // Maybe we want to save some variables in a session. In that case,
    // example:
    $_SESSION['login'] = array(
        'user_id' => $uid, // Replace by the ID of the user you're logging in.
        'username' => $uname
    );

    // (In order for the session to work, you need to have used session_start();
    // before).

    // There is no need to output this message, as the user is being
    // redirected anyway, but I'll lave it in tact for you ;).
    echo "Welcome $uname";
}
else
{
    echo "Username and Password do not match";
}

More info about session_start() on php.net: click.

Oh, and a thing to get you started on password encryption: . Note that this tutorial is using the md5() function, of which the use is strongly unadvised (as it is seen as deprecated by almost everyone), but it will give you an idea of what password encryption is.

Edited by minitauros
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.