PHP login session not coming through (Login with SQL database)

Question

The latest little 'challenge' I've made for myself is trying to code a good login screen on a site I'm making for some friends. However, when I input my email and password as they are displayed in my SQL database, the file I use to check it with does not send out anything at all. My code looks as follows:

<?php
    session_start();
    
    if (isset($_SESSION['user'])) {
        header('Location: mainpage.php');
    }
    
    require_once 'config.php';
    
    $error_message = '';
    if (isset($_POST['submit'])) {
        $db = "epiz_31045019_TCDB";
        $response = $db->check_credentials($_POST['email'], $_POST['password']);
    
        if ($response['status'] == 'success') {
            $_SESSION['user'] = array('id' => $response['id'], 'nickname' => $response['nickname']);
            header('Location: mainpage.php');
        }
    }
?>

If that might prove to be useful, here are my login form and the config code I'm including as well:

<?php
  $hostnaam = "host.com";
  $gebruikersnaam = "username";
  $wachtwoord = "password";
  $db = "database";
  $verbinding = mysqli_connect($hostnaam, $gebruikersnaam, $wachtwoord,
  $db) or die ("Er kan geen verbinding tot stand worden gebracht:" .
  mysqli_connect_error());
?>

    <form action="datacheck.php" method="POST">
        <div class="form-field">
            <input type="email" name="email" id="email" placeholder="E-mailadres" required /> 
        </div> <br>
        <div class="form-field">
            <input type="password" name="password" id="password" placeholder="Wachtwoord" required /> 
        </div> <br>
        <div class="form-field">
            <button class="btn" type="submit">Log in</button>
        </div>
    </form>

After your `header` you really, **really** should add `exit;` to stop the rest of the script execution. — Martin, May 27 '22 at 20:03
It looks like you are using some really bad tutorial. I highly encourage you to find something better. If you are only starting to learn PHP then you should learn PDO instead of mysqli. PDO is much easier and more suitable for beginners. Start here https://phpdelusions.net/pdo & https://websitebeaver.com/php-pdo-prepared-statements-to-prevent-sql-injection. Here are some good video tutorials https://youtu.be/2eebptXfEvw & https://www.youtube.com/watch?v=sVbEyFZKgqk&list=PLr3d3QYzkw2xabQRUpcZ_IBk9W50M9pe- — Dharman, May 27 '22 at 20:40
You need to stop manually checking for errors. Please read: [Should we ever check for mysqli_connect() errors manually?](https://stackoverflow.com/q/58808332/1839439) and [Should I manually check for errors when calling “mysqli_stmt_prepare”?](https://stackoverflow.com/q/62216426/1839439) — Dharman, May 27 '22 at 20:41

Martin · Accepted Answer · 2022-06-05T21:50:15.833

DATA SECURITY:

Your code example:

  $hostnaam = "host.com";
  $gebruikersnaam = "username";
  $wachtwoord = "password";
  $db = "database";
  $verbinding = mysqli_connect($hostnaam, $gebruikersnaam, $wachtwoord,
  $db) or die ("Er kan geen verbinding tot stand worden gebracht:" .
  mysqli_connect_error());

Good Practise:

If you are using variables to hold connection/login information you are going to use them once and then not need them, but later on in your code, all of those variables ($wachtwoord, $gebruikersnaam, etc.) still exist.

In the example you give, it would be safer practise to

hardcode the data directly into the connection function:

mysqli_connect("host.com", "username", "password", "database");

or Ensure you destroy the data as soon as you've finished with it:

$hostnaam = "host.com";
$gebruikersnaam = "username";
$wachtwoord = "password";
$db = "database";
$verbinding = mysqli_connect($hostnaam, $gebruikersnaam, $wachtwoord,
$db);
unset($hostnaam,$gebruikersnaam, $wachtwoord,$db);
// Or alternatively:
// $hostnaam = $gebruikersnaam = $wachtwoord = $db = NULL;

Using diestatements and showing error messages directly to the browser / user is VERY bad practise and should never be done.

Try instead to throw errors to the PHP error log.

    if(!mysqli_connect("host.com", "username", "password", "database")){
       error_log("There was a failure to connect to MySQL: ".mysqli_connect_error());
       header("location: index.php?msg=".urlencode('Sorry there was an error.Can not connect.');
    }

Your header functions should always be followed by die/exit statements because when a header function is reached, PHP will continue to execute the rest of the script, even while the browser is redirected to a new page.

Bringing it all together:

    if(!mysqli_connect("host.com", "username", "password", "database")){
       error_log("There was a failure to connect to MySQL: ".mysqli_connect_error());
       header("location: index.php?msg=".urlencode('Sorry there was an error.Can not connect.'));
       exit;
    }

And finally, I would also highly recommend using PDO interface and using object orientated programming.

PHP login session not coming through (Login with SQL database)

1 Answers1

DATA SECURITY:

Good Practise:

Bringing it all together: