Else statement is printed before I fill in the form

Question

cosmo13 23 Newbie Poster

5 Years Ago

Hey there! I don't know why "Your Password is Incorrect!" is printed before I fillin the form. I've started learning php two weeks ago

<!DOCTYPE html>
<html>
    <head>
    </head>
    <body>

<form action = "" method="POST">

        <label id="first"> Name: </label><br/>
        <input type="text" name="username" placeholder= "Name" required><br/>

        <label id="first">Password: </label><br/>
        <input type="password" name="password" required><br/>

        <input type="submit" name= "submit" value="Sign in">
        </form>

    </body>
</html>
<?php
     require('p.php');   
    if(isset($_POST['submit'])){
      if(isset($_POST['username']) && isset($_POST['password'])){

        $username = $_POST['username'];
        $password = $_POST['password'];

    $sql = "SELECT * FROM mydatab.form WHERE name='$username' AND passw='$password' limit 1";
    $result = mysqli_query($conn, $sql) or trigger_error(mysqli_error($conn), E_USER_ERROR) ;

    if(mysqli_num_rows($result) === 1){
        echo " You Have Successfully Logged in";
    }
    else{
        echo " Your Password is Incorrect!";
    } }
    mysqli_close($conn);
}
?>

mysql php

4 Contributors
9 Replies
194 Views
3 Days Discussion Span
Latest Post 5 Years Ago Latest Post by Biiim

Dani AI

Generated 6 Months Ago

Brief diagnosis: the "Your Password is Incorrect!" output is coming from the login branch running and returning no match. Later posts show the script was receiving POST data, so the server-side check ran as written. Common culprits are a browser resubmitting stored POST data (the "confirm form resubmit" flow after refresh), an autofill extension or JavaScript that submits the form automatically, or server-side code in p.php that executes authentication logic at include time. correctly called out resubmission; correctly warned about unsafe password handling.

Quick debug checklist:

Verify whether the request is actually a POST by dumping $_SERVER['REQUEST_METHOD'] (not just the presence of a submit value).
Reproduce in a fresh private/incognito window to rule out autofill/extensions and cached POST.
Inspect p.php for any queries or echo statements that run on include — initialization files should only create the DB connection and not perform authentication.
Look for any client-side code (JS) or browser extensions that might auto-submit the form.
Log the prepared statement parameters (never log raw passwords in plain text) to confirm what values reach the query.

Recommended fixes and best practices:

Use a reliable POST check such as $_SERVER['REQUEST_METHOD'] === 'POST' rather than relying on the submit button value.
Apply the Post/Redirect/Get pattern: after successful login redirect to a different page to avoid browser resubmission prompts.
Use prepared statements to prevent SQL injection and store passwords hashed with password_hash() and verify with password_verify(). As noted, plaintext passwords are a serious issue.

Example (minimal pattern for verification and safety):

<?php
require 'p.php';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $u = trim($_POST['username'] ?? '');
    $p = $_POST['password'] ?? '';
    $stmt = $conn->prepare('SELECT pass_hash FROM form WHERE name = ? LIMIT 1');
    $stmt->bind_param('s', $u);
    $stmt->execute();
    $stmt->bind_result($hash);
    if ($stmt->fetch() && password_verify($p, $hash)) {
        echo 'You have successfully logged in';
    } else {
        echo 'Your Password is Incorrect!';
    }
}
?>

Finally, remove debug output in production and test the form flow in a clean browser profile. The immediate next check is the contents of p.php (as asked) — ensure it only opens the connection and does not run queries or echoes on include.

All 9 Replies

rproffitt 3,249 https://5calls.org

5 Years Ago

Which line do you feel is failing?

I'd print the result out as noted at https://www.w3schools.com/php/func_mysqli_num_rows.asp to see what is going on. It could be correct behavior if there is more than one match in the database.

Beyond that this code appears to store passwords in a database (never do that!) and looks to be exploitable with injections.
That's two big strikes against this code and if it was submitted at work or in a classroom it would be rejected then we begin again to discuss both of those topics.

cosmo13 commented: I tried the code from the link and it works fine. +0

Dani 5,664 The Queen of DaniWeb

5 Years Ago

Are you saying it gives the error message even if you are not intending to submit the form but rather just load the page to display the form to fill out?

What are the contents of the p.php file?

cosmo13 commented: p.php file creates connection to database and checks it +0

Biiim 215 Junior Poster

5 Years Ago

My guess on it saying "Your Password is Incorrect!" is that when you refresh a page that has been "post"ed to it will ask if you want to confirm resubmitting the form data, if you say yes it will send the post data again.

Otherwise based on your code it means that isset($_POST['submit']) is evaluating to true, isset($_POST['username']) && isset($_POST['password']) is evaluating to true and mysqli_num_rows($result) === 1 is evaluating to false.

Try adding var_dumps to detect it:

<?php
var_dump($_POST);
require('p.php');
if(isset($_POST['submit'])){
    echo 'submit exists';
    if(isset($_POST['username']) && isset($_POST['password'])){
        echo 'username & password exists';
        $username = $_POST['username'];
        $password = $_POST['password'];

        $sql = "SELECT * FROM mydatab.form WHERE name='$username' AND passw='$password' limit 1";
        $result = mysqli_query($conn, $sql) or trigger_error(mysqli_error($conn), E_USER_ERROR) ;

        if(mysqli_num_rows($result) === 1){
            echo "1 row";
            echo " You Have Successfully Logged in";
        }else{
            echo " Your Password is Incorrect!";
            echo "not exactly 1 row: ".var_dump(mysqli_num_rows($result));
        }
    }
    mysqli_close($conn);
}
echo "end";
?>

rproffitt commented: Excellent advice. Time to see what is in those variables. +15

cosmo13 commented: I tried your code and it prints: array(3) { ["username"]=> string(4) "Eric" ["password"]=> string(4) "1234" ["submit"]=> string(7) "Sign in" } submit +0

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

I tried your code and it prints: array(3) { ["username"]=> string(4) "Eric" ["password"]=> string(4) "1234" ["submit"]=> string(7) "Sign in" } submit

rproffitt 3,249 https://5calls.org Team Colleague · Answer 1 · 2021-01-26T19:25:15+00:00

Share that new code with the print statement as well as what printed.

cosmo13 23 Newbie Poster · Answer 2 · 2021-01-26T19:34:04+00:00

<?php
     require('p.php');   


    $sql="SELECT name,passw FROM mydatab.form ORDER BY name";

    if ($result=mysqli_query($conn,$sql))
      {
      // Return the number of rows in result set
      $rowcount=mysqli_num_rows($result);
      printf("Result set has %d rows.\n",$rowcount);
      // Free result set
      mysqli_free_result($result);
      }


    mysqli_close($conn);

?>

It prints: Result set has 18 rows.

rproffitt 3,249 https://5calls.org Team Colleague · Answer 3 · 2021-01-26T19:39:25+00:00

18 rows would indeed cause the origianal top post to do the password is incorrect if that was the result.
But we want to see the number of rows at line 30 in your original code (top post.)

cosmo13 23 Newbie Poster · Answer 4 · 2021-01-28T16:16:22+00:00

I tried the code using var_dumps and it prints:
array(3) { ["username"]=> string(4) "Eric" ["password"]=> string(4) "1234" ["submit"]=> string(7) "Sign in" } submit existsusername & password exists Your Password is Incorrect!int(0) not exactly 1 row: end
But I can't see how this helps me to fix the problem.

What if Eric has 18 entries in the database? Next thing to check.
That code tells me that mysqli_num_rows() is returning 0. So your username and password do not match to an entry in the database.

rproffitt 3,249 https://5calls.org Team Colleague · Answer 5 · 2021-01-28T16:58:09+00:00

While I wonder why there are 18 rows, maybe you should rethink line 29 in your original code. Don't pollute your $result with trigger_error.

https://www.php.net/manual/en/function.trigger-error.php for reference.

Biiim 215 Junior Poster · Answer 6 · 2021-01-29T17:27:53+00:00

I tried the code using var_dumps and it prints:
array(3) { ["username"]=> string(4) "Eric" ["password"]=> string(4) "1234" ["submit"]=> string(7) "Sign in" } submit existsusername & password exists Your Password is Incorrect!int(0) not exactly 1 row: end

So if you follow the print outs it tells you that it is getting to here if(mysqli_num_rows($result) === 1){ and is evaulating to false because mysqli_num_rows($result) is an integer of 0.

This means $sql = "SELECT * FROM mydatab.form WHERE name='$username' AND passw='$password' limit 1"; is not finding any rows in the database.

What about doing $sql = "SELECT * FROM mydatab.form WHERE name='{$username}' AND passw='{$password}' limit 1"; I usually put curly brackets around php variables in strings so i'm not sure if it will translate the variable without curly brackets around them

Else statement is printed before I fill in the form

Dani AI

Recommended Answers Collapse Answers

All 9 Replies

Recommended Answers