Member Avatar for shielaolid

Hello there, anyone can help me about my problem, i want to display an error message when the user inputs invalid username and incorrect password. and i want to display it in the same form. im new in php.

These are my codes:

<?php
	if($_SERVER['REQUEST_METHOD'] == 'POST')
	{
						$db=mysql_connect('localhost','root','') or die('Cannot connect to MySQL!');
@mysql_select_db('dbriomra')or die('Cannot connect to database');
 
// Retrieve username and password from database according to user's input
 
$login = mysql_query("SELECT * FROM login WHERE (username = '" . mysql_real_escape_string($_POST['compid']) . "') and (password = '" . mysql_real_escape_string($_POST['pword']) . "')");
 
// Check username and password match

if (mysql_num_rows($login) == 1) {
// Set username session variable

$_SESSION['username'] = $_POST['compid'];
// Jump to secured page
header('Location: employee.php'); 

// kung anong file.php mag ffall ung user pag valid ung log in procedures nya.
}
else {
$message = "Invalid username or password"; 
}
} else {
$message = "";
}
echo "$message";
?>
                
<?PHP print $message;?>
  • 3 Contributors
  • 4 Replies
  • 7K Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by shielaolid

Dani AI

Generated

A couple of things will make this safer and easier to show errors on the same form:

  • Do not use the old mysql_* API or store plaintext passwords in sessions. Use prepared statements and password_hash/password_verify, start the session once, and keep error text in a variable you render above the form. Also avoid different messages for username vs password to prevent user enumeration.
  • If you redirect after login, call exit; immediately. Use a relative URL like employee.php if the file is in the same folder; a leading slash points to the web root and can cause the "not found" error you saw.

Example pattern you can drop at the top of the same PHP file that renders your form:

<?php
session_start();
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $user = trim($_POST['username'] ?? '');
    $pass = $_POST['password'] ?? '';

    $mysqli = new mysqli('localhost', 'root', '', 'dbriomra');
    if ($mysqli->connect_errno) { $error = 'Temporary login issue.'; }

    if (!$error) {
        $stmt = $mysqli->prepare('SELECT id, password_hash FROM login WHERE username = ?');
        $stmt->bind_param('s', $user);
        $stmt->execute();
        $stmt->bind_result($id, $hash);
        if ($stmt->fetch() && password_verify($pass, $hash)) {
            session_regenerate_id(true);
            $_SESSION['id'] = $id;
            $_SESSION['username'] = $user;
            header('Location: employee.php');
            exit;
        }
        $error = 'Invalid username or password';
    }
}
?>
<!-- In your HTML form area -->
<?php if ($error) echo '<p class="error">'.$error.'</p>'; ?>

Docs: password_hash/password_verify, mysqli prepared statements, sessions, and why mysql_* was removed in PHP 7 (php.net intro.mysql).

Recommended Answers

All 4 Replies

Member Avatar for vaultdweller123

put this above html

$user = $_POST['compid'];
$pass = $_POST['pword'];

$db=mysql_connect('localhost','root','') or die('Cannot connect to MySQL!');
@mysql_select_db('dbriomra')or die('Cannot connect to database');
session_start();

$sql = mysql_query("SELECT * FROM login WHERE username = '".$user."'");

if(mysql_num_rows($sql)>0){

	// login
	while($row=mysql_fetch_array($sql)){

		if($pass==$row['password']){
			// store id as session
			$_SESSION['id'] = $row['id'];
			echo "<script>window.location='/employee.php'</script>";
		}else{
		// password incorrect
			echo 'password incorrect';
		}

	}
}else{
	// fail
	echo "username doesn't exist";
}

then remove the action attribute in your form

Edited by vaultdweller123 because: n/a
Member Avatar for shielaolid

vaultdweller123, Undefined compid and pword (that's the name of my textboxes).

and if when i input the correct username and password this is the error that i get

"The requested URL /employee.php was not found on this server."

employee.php is the page where the user go directly when they input correct username and password.

Edited by shielaolid because: n/a
Member Avatar for baig772

share your form also

Member Avatar for shielaolid

It's working.

<?php

error_reporting (E_ALL ^ E_NOTICE);
	
session_start();

$user = $_POST['txtcompid'];
$pass = $_POST['txtpword'];

$_SESSION['myusername'] = $user;
$_SESSION['mypassword'] = $pass;
 
$db=mysql_connect('localhost','root','') or die('Cannot connect to MySQL!');
@mysql_select_db('dbriomra')or die('Cannot connect to database');
session_start();
 
$sql = mysql_query("SELECT * FROM login WHERE username = '".$user."'");
 
if(mysql_num_rows($sql)>0){
 
	// login
	while($row=mysql_fetch_array($sql)){
 
		if($pass==$row['password']){
			// store id as session
			$_SESSION['id'] = $row['id'];
			header("location:employee.php");
			$_SESSION['username']=$user;
			
		}else{
		// password incorrect
			echo 'password incorrect';
		}
 
	}
}else{
	// fail
	echo "username doesn't exist";
}
?>

i just put a

$_SESSION['myusername'] = $user;
$_SESSION['mypassword'] = $pass;

to call my textboxes. and that's it. Thanks :) Have a nice day!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.