1

Having problems with my login php code..

I have a basic form which submits to "checklogin.php' which is the code below. Once you submit the login credentials it just stays on "checklogin.php' and nothing is displayed. Has anyone got any ideas? 

<?php

$host="localhost"; // Host name 
$username="alex"; // Mysql username 
$db_name="test"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword"); 
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}

?>
PeeHaa
  • 71,436
  • 58
  • 190
  • 262
Alex Anderson
  • 153
  • 2
  • 10
  • Sometimes the empty rows in the code cause problems, try using an other way to redirect. Header need be the first line in the "html" resultant – esdebon Mar 13 '14 at 20:52
  • This code comes from the same place as someone else [`posted a day or so ago`](http://stackoverflow.com/q/22354466/). I'm not touching this one; too many moving parts. [`This`](http://www.phpeasystep.com/phptu/6.html) is most likely its origin. – Funk Forty Niner Mar 13 '14 at 22:18
  • 1
    @Fred-ii- Goddamnit. Can we please find out whose site that is and punch him in the face ask him nicely to bring down that horrible site. – PeeHaa Mar 15 '14 at 23:31
  • 1
    @PeeHaa I couldn't agree with you more. How often have I seen that same piece of code being passed around with the same problem, over and over again. As I've said more often than none; "code is like a fingerprint, a signature", just like a piece of fine art ;-) – Funk Forty Niner Mar 16 '14 at 00:59

2 Answers2

0

First thing I noticed was the "Protect MySQL Injection"... mysql_real_escape_string is not 100% safe... You should use prepared statements.

Check if you don't have any blank spaces after your "?>" and also make sure you are not "echoing" anything before you do the header("location:login_success.php"); thing.

Jhuliano Moreno
  • 929
  • 8
  • 23
  • 2
    Can you explain "mysql_real_escape_string is not 100% safe" or provide references? – symcbean Mar 13 '14 at 20:56
  • @symcbean there is a big thread here in StackOverflow explaining it, take a look at it: [reference](http://stackoverflow.com/questions/110575/do-htmlspecialchars-and-mysql-real-escape-string-keep-my-php-code-safe-from-inje) NOTE: please note I said it's not 100% safe and not that it's UNSAFE for every case, prepared statements are just a better and more elegant option. – Jhuliano Moreno Mar 13 '14 at 20:59
  • OK - interesting. Mostly wrong though. Depending on the implementation, satements may be parsed client side (same as using msq – symcbean Mar 13 '14 at 21:10
  • Sorry - interrupted during that and now can't edit my comment. Should say.....Thanks JM. So if you write really stupid code, mysql_real_escape_string() won't help. The discussion there also misses out on a whole lot of points. Depending on the implementation, statements may be parsed client side or server-code - the 2 approaches have very different characteristics. Yes, if you blindly apply it to integer values with embedded expressions it won't escape them - but surely nobody is that stupid? The clue is in the name - its mysql_real_escape_**string** not mysql_real_escape_number/date/boolean. – symcbean Mar 13 '14 at 21:19
  • I think you would be amused by the amount of people that use those functions blindly. But IMO, prepared statements are much more elegant and simple. I don't see any reasons to use mysql_real_escape functions over it, so that is why I pointed it out :). – Jhuliano Moreno Mar 14 '14 at 02:52
0

The if statement at the end only allows for 3 possibilities:

  1. the code failed fatally and never got to the 'if' statement
  2. the password did not match and you would have got a message saying so
  3. the password was validated but the header() call failed with an error

Since you got a blank page this means that either 1 or 3 happened. In both cases an error would have been reported somewhere. Your problem is that you don't know how to find the messages that PHP is trying to tell you about.

(BTW the answer is most likely that the script generated some output before the all to header() and so it failed)

symcbean
  • 47,736
  • 6
  • 59
  • 94