Member Avatar for UK-1991

Hello,

I created a user login form with a crietaria fixed that if the user type is admin then it should be redirected to admin page and if it is an agent it should be redirected to home.php

The admin type is working properly but when i enter agent id and paw it redirects back to login page

here is the code

<?php
    include_once ("connection.php");

    $username = $_POST["user_name"];
    $password = $_POST["password"];

    $query = "SELECT * FROM agents";
    $query_confirm = mysqli_query($connection, $query);

    while ($record = mysqli_fetch_assoc($query_confirm)) {
        $id = $record["id"];
        $uname = $record["agent_uname"];
        $user_pass = $record["agent_password"];
        $user_type = $record["user_type"];
    }

    if(isset($_POST["login"])) {
        if($username == $uname  && $password == $user_pass) {
            if($user_type == "Admin") {
                header("Location: ../admin.php?admin=".$id);
                exit;
            } else {
                header("Location: ../home.php?agent=".$id);
                exit;
            }
        } else {
            header("Location: ../login.php");
        }
    }

?>

Thank You

  • 5 Contributors
  • 7 Replies
  • 278 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by UK-1991

Dani AI

Generated

The problem was exactly what pointed out: your verify script loaded every row from agents and then overwrote $id,$uname,$user_pass,$user_type for each record, so only the last row remained for the comparison. That made the check fail for most users. A more robust approach is to fetch only the submitted user (use a WHERE + LIMIT 1, or a prepared statement) and verify the password, then start a session and redirect.

Example (safe, not identical to the original):

<?php
require_once 'connection.php';
session_start();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    header('Location: ../login.php');
    exit;
}

$username = trim($_POST['user_name']);
$password = $_POST['password'];

$stmt = mysqli_prepare($connection,
    'SELECT id, agent_password, user_type FROM agents WHERE agent_uname = ? LIMIT 1'
);
mysqli_stmt_bind_param($stmt, 's', $username);
mysqli_stmt_execute($stmt);
mysqli_stmt_bind_result($stmt, $id, $hash, $user_type);

if (mysqli_stmt_fetch($stmt) && password_verify($password, $hash)) {
    $_SESSION['user_id'] = $id;
    $_SESSION['user_type'] = $user_type;
    if ($user_type === 'Admin') {
        header('Location: ../admin.php?admin='.$id);
        exit;
    }
    header('Location: ../home.php?agent='.$id);
    exit;
}

header('Location: ../login.php?error=invalid');
exit;
?>

Quick troubleshooting checklist (gaps I saw in replies):

  • Confirm your form uses method="post" and the submit has a name if you rely on isset($_POST['login']) (as asked). Using $_SERVER['REQUEST_METHOD'] === 'POST' is cleaner.
  • Use password_hash() when creating users and password_verify() here. Plaintext comparisons are fragile and insecure.
  • Ensure no output (including BOM or stray whitespace) happens before header() calls — ’s echo trick is great for debugging but remove echoes before redirecting.
  • Keep redirects and session handling atomic: call session_start() early, set session vars, then redirect and exit.

Security notes: avoid revealing whether username or password was wrong, use HTTPS, regenerate session IDs after login, and rate-limit failed attempts.

Recommended Answers

All 7 Replies

Member Avatar for jstfsklh211

post your form

where does $_POST["login"] get set

Member Avatar for terrymason

I find it's easy to troubleshoot by just putting some echo statements in and seeing what's being sent.

    if(isset($_POST["login"])) {

echo "<br />the user_type is ".$user_type;   
echo "<br />the username is ".$username; 

    }

I'm not sure that you need those exit; statements.

Member Avatar for UK-1991

Here is the form

<?php 
    require_once("includes/connection.php");
?>
<!DOCTYPE HTML>
<html>
<head>
<title> Green Gadget - Login</title>
<meta http-equiv="Content-Type" content="text/html;">

    <link type="text/css" rel="stylesheet" href="css/style.css" />
    <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css">

</head>

<body>
    <div id="main_page" style="  padding: 152px 0;">
    <p class="heading_login">LOGIN</p>
        <div id="login">
        <form name="login" method="post" action="includes/verify.php">
            <label>
                <p>User Name</p>
                <input type="text" name="user_name" class="txtfield_login" required />
                <div class="clear"></div>
            </label>

            <label>
                <p>Password</p>
                <input type="password" name="password" class="txtfield_login" required />
                <div class="clear"></div>
            </label>

            <input type="submit" class="formbtn_login" value="Login" name="login" />
        </form>
        <div class="clear"></div>
        </div>
    </div>

</body>
</html>
Member Avatar for UK-1991

the indormation echoing is correct but dont know why it's not confirming it

Member Avatar for lps

Try to review your code

$query = "SELECT * FROM agents";
    $query_confirm = mysqli_query($connection, $query);
    while ($record = mysqli_fetch_assoc($query_confirm)) {
        $id = $record["id"];
        $uname = $record["agent_uname"];
        $user_pass = $record["agent_password"];
        $user_type = $record["user_type"];
    }

From what I see, you select all record from agents table and overwrite the $id,$uname,$user_pass,$user_type for each record. This means these variable will only store the last data from the database. Then your code on if($username == $uname && $password == $user_pass) will return false.

If I am in the case, I will probably change the code into

if(isset($_POST["login"])) {//if not posted, no need to fetch from database
    while ($record = mysqli_fetch_assoc($query_confirm)) {
        $id = $record["id"];
        $uname = $record["agent_uname"];
        $user_pass = $record["agent_password"];
        $user_type = $record["user_type"];
        if($username == $uname  && $password == $user_pass) {
            if($user_type == "Admin") {
                header("Location: ../admin.php?admin=".$id);
                exit;
            } else {
                header("Location: ../home.php?agent=".$id);
                exit;
            }
        } else {
            header("Location: ../login.php");
        }
    }
} else {
    header("Location: ../login.php");
}
Member Avatar for slowlearner2010

Have you try this?

if(($username == $uname) && ($password == $user_pass))

Member Avatar for UK-1991

, Perfect so this was the big mistake I was doing on I tried to done every form processing within the loop and it did worked thank you once again.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.