PHP refusing to redirect registered user

Question

pranay1995 -1 Light Poster

14 Years Ago

hi all:

i am trying to use this code to login to members area but everytime i try to login with a registered user it redirects to the registration page please help.

below is the code:

<?php
session_start();
$uname="root";
$pword="";
$host="localhost";
$database="spl";

$Username=$_POST['Username'];
$Password = MD5($_POST['Password']);

$_SESSION['Username']=$Username;

mysql_connect("$host", "$uname", "$pword")or die("cannot connect");
mysql_select_db("$database")or die("cannot select DB");

$checkUsername=mysql_query("select Username, Password from registration where Username='Username' and Password='Password'");

$Username_exist=mysql_num_rows ('$checkUsername');

if ($Username_exist>0)
{
    header("location:indexma.php");
}
else 
{
    echo "not registered";
    header("location:register.php");
}
?>

and also how do i destroy a session please help ASAP. thank you

php session

Edited 14 Years Ago by pranay1995

4 Contributors
19 Replies
220 Views
1 Month Discussion Span
Latest Post 14 Years Ago Latest Post by pranay1995

Dani AI

Generated 7 Months Ago

A short, focused diagnosis and a safer fix.

The immediate failure in this thread came from a mix of syntax bugs and outdated practices: the SQL was using literal identifiers instead of the variables (as flagged), the result-count check was being given a string instead of the query resource (the warning shown in Post #12), and a session value was being set before any credential check. Those quick fixes (variable interpolation, remove stray quotes around the result, stop execution after redirects as suggested) address the symptoms, but the code should also move off the old mysql_* API and away from MD5-based passwords for long-term correctness and security. (wiki.php.net)

A minimal, modern login flow (uses PDO + password verification; assumes stored hashes created with password_hash):

<?php
session_start();

$pdo = new PDO('mysql:host=localhost;dbname=spl;charset=utf8mb4', 'root', '', [
  PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
]);

$stmt = $pdo->prepare('SELECT id, Password FROM registration WHERE Username = :u LIMIT 1');
$stmt->execute([':u' => $_POST['Username'] ?? '']);
$row = $stmt->fetch(PDO::FETCH_ASSOC);

if ($row && password_verify($_POST['Password'] ?? '', $row['Password'])) {
  session_regenerate_id(true);
  $_SESSION['user_id'] = $row['id'];
  header('Location: indexma.php'); exit;
}
header('Location: register.php'); exit;
?>

Use prepared statements to prevent SQL injection and password_hash/password_verify for safe hashing; see PDO::prepare and password_hash docs. (php.net)

Practical troubleshooting and cleanup notes: (1) Check for “headers already sent” — no echoes/HTML/BOM before header() (use headers_sent() or output buffering while debugging). (2) Log or surface database errors when developing (exceptions or error_info). (3) On logout, clear the session array, delete the session cookie if present, then destroy the session to avoid stale IDs; also call session_regenerate_id(true) after successful login to prevent fixation. See the PHP session docs for recommended patterns. (php.net)

These changes resolve the immediate redirect bug and bring the code up to modern, safer PHP practices.

All 19 Replies

broj1 356 Humble servant

14 Years Ago

The trouble could be in your query on line 16 where you should use the variables (but you probably only forgot the $ sign). The correct query would be:

$checkUsername=mysql_query("select Username, Password from registration where Username='$Username' and Password='$Password'");

ryantroop 177 Practically a Master Poster

14 Years Ago

get rid of the ' ' around $checkUsername

There should only be 1 result if the user/pass combo exists. No one will have the same username, right? So change line 20 to:

if($Username_exists == 1) {
 header("Location: indexma.php");
 exit();//all header redirects need to kill the script or it will continue to run even after a redirect
}
else {
 //echo will not ever be seen, and it should in fact raise an error if something is output before a header change
 header("Location: register.php");
 exit();//same dealy here
}

EDIT: The above is very possible, as well. But I would encourage my changes as well.

Edited 14 Years Ago by ryantroop

ryantroop 177 Practically a Master Poster

14 Years Ago

destroying a session:

$_SESSION['PHPSESSID'] = '';
session_destroy();

as for your problem, on line 16 add:

or die(mysql_error()); and see if your sql is failing.

EDIT: changed cookie name. Spelling error :(

Edited 14 Years Ago by ryantroop

ryantroop 177 Practically a Master Poster

14 Years Ago

youre sure that the user and the hashed password exist in the database?

ryantroop 177 Practically a Master Poster

14 Years Ago

line 19, write:

echo "Username_exists"; exit();

What number is there?

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

pranay1995 -1 Light Poster · Answer 1 · 2012-08-16T07:52:23+00:00

broj1 thank you for the help but yet having the same problem :( pls help

pranay1995 -1 Light Poster · Answer 2 · 2012-08-16T07:54:37+00:00

pranay1995 -1 Light Poster

14 Years Ago

ryantroop nop still the same

pranay1995 -1 Light Poster · Answer 3 · 2012-08-16T07:59:40+00:00

ryantroop pls help i added that code and nothin please

pranay1995 -1 Light Poster · Answer 4 · 2012-08-16T08:01:42+00:00

pranay1995 -1 Light Poster

14 Years Ago

yes

broj1 356 Humble servant Featured Poster · Answer 5 · 2012-08-16T08:06:16+00:00

Let's debug the query first. Put this on line 17 and post the output:

die("select Username, Password from registration where Username='$Username' and Password='$Password'");

pranay1995 -1 Light Poster · Answer 6 · 2012-08-16T08:11:01+00:00

( ! ) Warning: mysql_num_rows() expects parameter 1 to be resource, string given in C:\wamp\www\Shivam1\login1.php on line 16
Call Stack
#   Time    Memory  Function    Location
1   0.0005  374144  {main}( )   ..\login1.php:0
2   0.0033  382864  mysql_num_rows ( )  ..\login1.php:16
select Username, Password from registration where Username='mo' and Password='30822eb8a7af334741f6867927a8c38f'

ryantroop 177 Practically a Master Poster · Answer 7 · 2012-08-16T08:15:03+00:00

ryantroop 177 Practically a Master Poster

14 Years Ago

on line 18 you took out the single quotes, yes?

broj1 356 Humble servant Featured Poster · Answer 8 · 2012-08-16T08:32:23+00:00

Maybe you post the last version of the code since so many suggestions came in.

pranay1995 -1 Light Poster · Answer 9 · 2012-08-16T09:37:59+00:00

i was in class any way no the form action is login1.php

pranay1995 -1 Light Poster · Answer 10 · 2012-08-16T09:47:00+00:00

ryantroop the code below doesnt work
echo "Username_exists"; exit();

bad.boy.Vlad 0 Newbie Poster · Answer 11 · 2012-08-16T12:31:51+00:00

$checkUsername=mysql_query("select Username, Password from registration where Username='$Username' and Password='$Password'");

youre code is correct i hope you just forget tu put $ ... :))

pranay1995 -1 Light Poster · Answer 12 · 2012-08-16T16:03:43+00:00

i did try the $ sign but yet no luck so thats not a problem

ryantroop 177 Practically a Master Poster · Answer 13 · 2012-08-16T17:59:15+00:00

my mistake, I forgot $ this time...

echo "$Username_exists"; exit();

Your answer should be a 1 or a 0

pranay1995 -1 Light Poster · Answer 14 · 2012-09-18T06:59:52+00:00

pranay1995 -1 Light Poster

14 Years Ago

Nope yet not working

PHP refusing to redirect registered user

Dani AI

Recommended Answers Collapse Answers

All 19 Replies

Recommended Answers