Member Avatar for Sean_F

Hey, im trying to make a PHP Login box for a program that i am making for my A Level project
however, im new with PHP so dont really know much about the code :( lol.

this is what i have so far

<html>

<body>

<?php

$username = "Admin";
$password = "Password";

if ($username=!$password; )
{ 
     print "The Username or Password is incorrect";
}

elseif ($username=$password; )
{
    (i want it to go to a webpage if the username and password match)
}

?>

<p align="left"><font face="Arial" size="5"><b>Login</b></font></p>
<table border="0" width="29%" id="table2">
    <tr>
        <td><b><font face="Arial" size="4">Username:</font></b></td>
        <td width="148"><input type="text" name="Username" size="20"></td>
    </tr>
    <tr>
        <td><b><font face="Arial" size="4">Password:</font></b></td>
        <td width="148"><input type="password" name="Password" size="20"></td>
    </tr>
</table>



</body>
</html>

im not sure if this is correct or not.
if there is somebody that can help can you please email me.
[email snipped]
or, post here.

thanks alot

Sean

Edited by TrustyTony because: fixed formating
  • 2 Contributors
  • 2 Replies
  • 111 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by Sean_F

Dani AI

Generated

Nice to see got it running and thanks to for the quick syntax help. Once the basic logic and form submission work, a few practical steps will make the login safe and reliable for real use.

Keep session state on the server and redirect cleanly after login. Start the session before any output, set a session flag or user id, regenerate the session id on successful login, then redirect and exit so the rest of the script never runs:

<?php
session_start();
// after successful auth:
$_SESSION['user_id'] = $userId;
session_regenerate_id(true);
header('Location: dashboard.php');
exit;
?>

Never store plaintext passwords. Use PHP built-ins to hash on registration and verify on login, and fetch the stored hash with a parameterized query (PDO or mysqli prepared statements) to avoid SQL injection:

$hash = password_hash($plainPassword, PASSWORD_DEFAULT);
// store $hash

// later, when checking:
if (password_verify($inputPassword, $hashFromDb)) {
    // authenticated
}

Harden the system: serve pages over HTTPS, set session cookie flags (Secure, HttpOnly), check request method before processing, rate-limit or lock accounts after repeated failures, and escape any user data you print with htmlspecialchars. Provide a logout route that clears and destroys the session:

session_start();
$_SESSION = [];
session_destroy();
setcookie(session_name(), '', time()-3600, '/');

If this is for learning, the above is a good checklist. For anything public-facing, prefer a tested library or framework auth component instead of rolling your own to avoid subtle security mistakes.

Recommended Answers

All 2 Replies

Member Avatar for senexom

Hey Sean,

You need to begin by learning the proper way of writing HTML, then the php syntax, then working on your logic...

Just so you know no one here is going to write code for you, well I guess I can only speak for my self. But I'll get you started on fixing your problems...

1. Your HTML is missing a <form></form> tags, which is essential if you want your information to be submitted somewhere.

2. The user name and password variables will overwrite your actual user name and password submitted from the form since they are named the same. Also look into using $_GET[], $_POST[], $_REQUEST[].

$username = "Admin";
$password = "Password";

3. Following line of code is checking if password is not equal to user name. Why would you check if password is the same as user name, makes not sense and has nothing to do with knowledge of PHP, your logic is missing.

if ($username=!$password; ) ...

Should be something along the lines of ...

if($secretUser==$_POST['username'] && $secretPass==$_POST['password']){
   // let them in...
} else {
  // display error message...
}

4.

elseif ($username=$password; )

First there is not elseif in PHP (that's VB syntax), Second, you must use double == signs when comparing values otherwise you have just assigned the value of $password to the $username.

Get this to work and comeback, there is more then enough references on google regarding what you're doing here. We'll be glad to help you further.

Member Avatar for Sean_F

yeah thanks alot.
i have sorted it out now and have fully working login boxes :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.