IF statement

Brief troubleshooting and a safer pattern to follow, given @cfnut’s original check and @dazzlindonna’s suggestion to either inline content or send a redirect.

The difference in behavior is simple: an inline include merges another template into the current server response, so content appears on the same page. A redirect instructs the browser to request a different URL, so the redirect header must be sent before any page output. Common causes of a “blank page” when redirecting: the redirect runs after output has already started (for example, inside a query-driven output block), the redirect runs repeatedly inside a loop, or the target path is wrong.

Two important fixes that are often missed: scope variables explicitly (don’t compare two identically named, unscoped variables) and avoid doing redirect logic inside a CFOUTPUT loop. A better flow is: fetch the user row by username (use cfqueryparam), check recordcount, compare the stored password (preferably a hash) to the submitted value, then issue the redirect and abort processing.

Example pattern:

<!--- fetch user safely --->
<cfquery name="qUser" datasource="myDSN">
  SELECT password_hash
  FROM users
  WHERE username = <cfqueryparam value="#FORM.username#" cfsqltype="cf_sql_varchar">
</cfquery>

<!--- check and redirect before any other output --->
<cfif qUser.recordcount EQ 1 AND qUser.password_hash EQ FORM.password>
  <cflocation url="/GetPictureFromUser.cfm" addtoken="no">
  <cfabort>
</cfif>

Additional tips: confirm the target file path exists and watch the browser’s Network/DevTools for a 3xx redirect response; use cfqueryparam to prevent SQL injection; store and compare password hashes rather than plaintext; and temporarily log or dump scoped values (not raw passwords) while debugging.