PHP error on login page

Question

A tried to create a login system and was stoped by an error which I can't solve !

Undefined index: user_name in C:\xamppp\htdocs\eatswrong\member.php on line 4

here is the login code !

<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];

if($username&&$password) {

$con = mysql_connect('localhost','root','')
        or die('An error occured while conneting  !');
mysql_select_db('blogpers') or die('Eroare la conectarea cu baza de date !');
$query = mysql_query("SELECT * FROM users WHERE username = '$username'");
$numrows = mysql_num_rows($query);

if ($numrows !=0) {

    while ($rows = mysql_fetch_assoc($query)){

        $dbusername = $rows['username'];
        $dbpassword = $rows['password'];

    }

    if ($username==$dbusername&&$password==$dbpassword) {
        echo "You're in ! <a href='member.php'>Click</a> here to enter the membership              page ! ";
        $_SESSION['user_name']=$username;
    } else{
        echo 'Incorrect password!';
    }

} else {
    die("That user doesn't exist !");
}

      } else {
 echo 'Please enter username and password !';
}
  ?>

And here is the membership page code :

<?php
  session_start();

  if($_SESSION['user_name']) {
      echo "Welcome, ".$_SESSION['user_name']."!"; 
   echo "<a href='logout.php'>Log OUT</a>";
   } else {
  echo "To acces this page please log in !";
   }

    ?>

The most likely cause could be that your form elements are not named or there's a typo. — Funk Forty Niner, Mar 03 '14 at 17:44
undefined index is not an error, it is a notice. and just check if it exists using (isset, array_key_exists) depends on your logic, and you need to know that your code is open for all security problems — mamdouh alramadan, Mar 03 '14 at 17:46
Then you may need to change `$username = $_POST['username'];` to `$username = $_POST['username'] = $_SESSION['user_name'];` then change your conditional statement to `if(isset($_SESSION['user_name']) && !empty($_SESSION['user_name'])){` — Funk Forty Niner, Mar 03 '14 at 17:52
$_SESSION['user_name'] only gets set if a successful login occurs, but your "welcome" code tries to access it unconditionally, whether a login occured or not. — Marc B, Mar 03 '14 at 17:59
[3,600+](http://stackoverflow.com/search?q=%5Bphp%5D+Undefined+index+is%3Aquestion) — Mike B, Mar 03 '14 at 18:17

score 2 · Answer 1 · edited Jun 20 '20 at 09:12

Solution to your problem

You get the notification (which won't stop the script from running or working in most cases) because you're checking for index 'user_name' inside $_SESSION, but the index is not set.

<?php
session_start();

if($_SESSION['user_name']) { // <-- Checking here, but there's nothing setting it above it. session_start(); does not set it

Use isset() to see if it's set instead. You probably also want to check that it's not empty using empty() or some other method that might even check that the username is valid.

About your use of mysql_*

Another thing to note is that you're using deprecated MySQL API, which the mysql_* functions are. See Choosing an API for an up-to-date, and more secure, choice.

Last but certainly not least

You're not sanitizing the input from the user - at all. If someone were to send their an SQL query (slightly modified) as their username, your script would run it and bad stuff could happen. If you're not going to switch to a more secure API, at least use mysql_real_escape_string().

ajtamwojtek · Answer 2 · 2014-08-14T11:46:10.667

0

I think that you should not fetch all info about user. It should be like this:

$query = mysql_query("SELECT * FROM users WHERE username = '$username' AND password ='$password' ");
$numrows = mysql_num_rows($query);

if ($numrows == 1) {

So, in the future:

-dont use mysql_* functions, it is deprecated and will be remove.Read about PDO

-read about functions empty() and isset().

Good luck:)

edited Aug 14 '14 at 11:46

answered Mar 03 '14 at 18:27

ajtamwojtek

763
6
19

score -1 · Accepted Answer · answered Mar 03 '14 at 17:53

-1

your warning is in membership page in this line:

if($_SESSION['user_name']) {

should be:

if(isset($_SESSION['user_name'])) {

you need to check if user_name is set in the session or not.It should solve your this issue.

answered Mar 03 '14 at 17:53

Awlad Liton

9,366
2
27
53

@Denis.: did you try this? – Awlad Liton Mar 03 '14 at 17:57

PHP error on login page

3 Answers3

Solution to your problem

About your use of mysql_*

Last but certainly not least