Member Avatar for shielaolid 
<?php

		$db=mysql_connect('localhost','root','') or die('Cannot connect to MySQL!');			
		@mysql_select_db('dbriomra')or die('Cannot connect to database');
		
		
		// Retrieve username and password from database according to user's input
		
		$login = mysql_query("SELECT * FROM login WHERE (username = '" . mysql_real_escape_string($_POST['compid']) . "') and (password = '" . mysql_real_escape_string($_POST['pword']) . "')");

		// Check username and password match
		if (mysql_num_rows($login) == 1) {
        // Set username session variable
        $_SESSION['username'] = $_POST['compid'];
        // Jump to secured page
        header('Location: employee.php'); // kung anong file.php mag ffall ung user pag valid ung log in procedures nya.
}
else {
       
        // Jump to secured page
        //header('Location: index.php'); //homepage mo pag invalid
}

?>

i want to put a restriction, like, invalid username and password, but i don't know how, im new in php. thank you :)

  • 3 Contributors
  • 3 Replies
  • 223 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by shielaolid

Dani AI

Generated

Good progress — the thread already shows two simple ways to surface an “invalid username/password” result: suggested returning to the login page with an indicator in the URL, and showed handling POST on the same page and setting a message. A few practical improvements make the result both safer and more user‑friendly: always call session_start() before using $_SESSION, stop execution after header('Location: ...') with exit, avoid the old mysql_* API, and store passwords hashed with password_hash() (check them with password_verify()).

Two patterns that work well in real apps:

  • Render the error on the same page: process the POST at the top, set an $error variable when login fails, and show it next to the form. Preserve the entered username using htmlspecialchars() so the user doesn’t have to retype it.
  • Redirect back to the form with a session “flash” message: set $_SESSION['error'] = 'Invalid username or password', redirect, then read-and-unset that session value on the login page. This keeps messages out of the URL and avoids exposing info in query strings.

Minimal secure example (replace DSN/credentials and ensure the password column stores hashes):

<?php
session_start();
$pdo = new PDO('mysql:host=localhost;dbname=dbriomra;charset=utf8mb4','dbuser','dbpass');
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $stmt = $pdo->prepare('SELECT username, password_hash FROM login WHERE username = ?');
    $stmt->execute([$_POST['compid']]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);
    if ($row && password_verify($_POST['pword'], $row['password_hash'])) {
        $_SESSION['username'] = $row['username'];
        header('Location: employee.php');
        exit;
    }
    $_SESSION['error'] = 'Invalid username or password';
    header('Location: index.php');
    exit;
}

Checklist when troubleshooting: session_start() must run before any output, follow header() with exit, enable error reporting during development, serve login pages over HTTPS, and plan for account lockout/rate‑limiting to mitigate brute force attempts.

Recommended Answers

All 3 Replies

Member Avatar for Member #120589

That's goes in your 'else' part.
You can send back to index.php with a querystring like:

index.php?login=fail

or something similar. The index page picks up the $_GET value if set.

Member Avatar for shahbaz13

As ardav said you can use the $_GET method...
If you do not want to use this method, use the other method.
In this method, you will have to place the above code on the login page and use the request type method i.e.

if($_SERVER['REQUEST_METHOD'] == 'POST')
{

}

...

Try this...

<?php
if($_SERVER['REQUEST_METHOD'] == 'POST')
{
		$db=mysql_connect('localhost','root','') or die('Cannot connect to MySQL!');
		@mysql_select_db('dbriomra')or die('Cannot connect to database');
 
 
		// Retrieve username and password from database according to user's input
 
		$login = mysql_query("SELECT * FROM login WHERE (username = '" . mysql_real_escape_string($_POST['compid']) . "') and (password = '" . mysql_real_escape_string($_POST['pword']) . "')");
 
		// Check username and password match
		if (mysql_num_rows($login) == 1) {
        // Set username session variable
        $_SESSION['username'] = $_POST['compid'];
        // Jump to secured page
        header('Location: employee.php'); // kung anong file.php mag ffall ung user pag valid ung log in procedures nya.
}
else {
$message = "Invalid username or password"; 
}
} else {
$message = "";
}
echo "$message";
?>
Member Avatar for shielaolid

Well, Thank you very much, you help me a lot :) my problem was solve :))))))

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.