PHP success login not working

Question

I'm using PHP and HTML for a user login, it works fine, it sends me error message when there are empty fields or when I enter a wrong password, but it fails when i want to re-direct me to the file if the 'username' and 'password' are properly admitted. Any ideas?

my PHP:

 <?php
 session_start();
?>

<?php require_once("../includes/connection.php"); ?>
<?php include("../includes/header.php"); ?>

<?php

if(isset($_SESSION["session_username"])){
// echo "Session is set"; // for testing purposes
header("Location:intropage.php");
}

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
$username=$_POST['username'];
$password=$_POST['password'];

$query =mysql_query("SELECT * FROM admin_list WHERE username='".$username."' AND password='".$password."'");

$numrows=mysql_num_rows($query);
 if($numrows!=0)
{
while($row=mysql_fetch_assoc($query))
{
  $dbusername=$row['username'];
  $dbpassword=$row['password'];
}

if($username == $dbusername && $password == $dbpassword)

{
$_SESSION['session_username']=$username;

/* Redirect browser */
  header("Location:intropage.php");
  }
} else {
  $message =  "Nombre de usuario ó contraseña invalida!";
  }

} else {
  $message = "Todos los campos son requeridos!";
  }
}
?>

HTML

<div class="container mlogin">
        <div id="login">
<h1>Logueo</h1>
 <form name="loginform" id="loginform" action="" method="POST">
<p>
    <label for="user_login">Nombre De Usuario<br />
    <input type="text" name="username" id="username" class="input" value=""     size="20" /></label>
</p>
<p>
    <label for="user_pass">Contraseña<br />
    <input type="password" name="password" id="password" class="input"   value="" size="20" /></label>
</p>
    <p class="submit">
    <input type="submit" name="login" class="button" value="Entrar" />
</p>
    <p class="regtext">No estas registrado? <a href="register.php"  >Registrate Aquí</a>!</p>
</form>

</div>

</div>

PHP empty field Error Message

<?php if (!empty($message)) {echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";} ?>

A general comment; your code is subject of SQL injection. Try to use a different approach for executing SQL statements. Moreover, storing a password per se in the database is also considered a bad practice. Take a look here http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — nmargaritis, Feb 19 '15 at 18:04
@NikosMargaritis dont leave him hanging! If you're going to have OP try something different, give them a direction to go in. — castis, Feb 19 '15 at 18:07
@IonTorres instead of the mysql_* functions, try using [PDO](http://php.net/manual/en/book.pdo.php) or [MySQLi](http://php.net/manual/en/book.mysqli.php) — castis, Feb 19 '15 at 18:08
@castis I was preparing the link to the actual thread. The options there are similar to what you suggested. — nmargaritis, Feb 19 '15 at 18:10
@castis my bad, by "it sends me error message." i mean it sends me an Alert when as a user left blank fields in my form it comes a message that says "All fields must be filled". — Ion Torres, Feb 19 '15 at 18:44
@NikosMargaritis Thanks I'll try to use a different approach for executing SQL as in your shared link, just as the links that Castis has shared too. — Ion Torres, Feb 19 '15 at 18:45
@IonTorres Please take a look here as well https://www.youtube.com/watch?v=8ZtInClXe1Q ("How NOT to Store Passwords! - Youtube") — nmargaritis, Feb 19 '15 at 19:17

score 0 · Answer 1 · answered Feb 19 '15 at 18:21

I think it may be a string literals issue which is causing the mysql query to fail.

Try changing:

$query =mysql_query("SELECT * FROM admin_list WHERE username='".$username."' AND password='".$password."'");

To this instead:

$query =mysql_query("SELECT * FROM admin_list WHERE username='$username' AND password='$password'");

PHP success login not working

1 Answers1