I think the header() raises a LOT of errors. So instead what I use is this:
<meta http-equiv='refresh' content="0; url=yoururlhere"
Leave it as is, and it will redirect you to a new page :) Works the same as header. This should fix your problems.
EDIT
Ok, here are some updates that will help make it more secure, and it should fix your problem! :)
First lets begin with the database connection file:
<?php
$db_username = ""; //Input your database username here
$db_password = ""; //Input your database password here
$db_host = ""; //Input your database host here
$db_name = ""; //Input your database name here
$options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8');
try {
$connection = new PDO("mysql:host={$db_host};dbname={$db_name};charset=utf8", $db_username, $db_password, $options);
$connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $ex) {
echo "Can not connect to database.";
}
header('Content-Type: text/html; charset=utf-8');
?>
The above will connect to your database for you! :)
Ok next lets work with the PHP (Please put this at the top of your , before your inputs):
<?php
//Grabs the database connection
require("path to database connection file");
$user = $_POST["user"];
$pass = $_POST["pass"];
$query="SELECT * FROM login WHERE username=:username AND password=:password";
$params->execute(array(':username' => $user,
':password' => $pass));
try{
$stmt = $connection->prepare($query);
$result = $stmt->execute($params);
}
catch(PDOException $ex){
echo ("Failed to run query: " . $ex->getMessage());
}
$fetch = $stmt->fetch();
if($fetch) {
while($row=mysql_fetch_assoc($query)){
$usernamefetch=$fetch['username'];
$passwordfetch=$fetch['password'];
}
if($user == $usernamefetch && $pass == $passwordfetch)
session_start();
$_SESSION['sess_user']=$user;
?>
<meta http-equiv='refresh' content="0; url=page_to_redirect_to"
<?php
{
else {
echo "Invalid username or password!";
}
}
else {
echo "Invalid username or password!";
}
?>
And that is the code, and it should work perfectly! :) The only thing you should make sure to change is the mets tag on where to redirect to. Then of course your simple HTML:
<form action="" method="POST">
Username: <input type="text" name="user">
Password: <input type="password" name="pass">
<input type="submit" value="Login" name="submit" />
</form>
Please test out this code, I think it will work much better now! :) Not to mention it will be much more secure.
EDIT
Finally, I got this to work 100%!!! :) Ok now use this:
<?php
$db_username = "peoplein"; //Input your database username here
$db_password = "xxxxxxx"; //Input your database password here
$db_host = "localhost"; //Input your database host here
$db_name = "xxxxxxxx"; //Input your database name here
$options = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8');
try {
$connection = new PDO("mysql:host={$db_host};dbname={$db_name};charset=utf8", $db_username, $db_password, $options);
$connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $ex) {
echo "Cannot connect to database.";
}
header('Content-Type: text/html; charset=utf-8');
?>
<!doctype html>
<html>
<head>
<title>Login</title>
</head>
<body>
<?php
if (isset($_POST["user"])) {
$user = $_POST["user"];
}
else {
$user = "";
}
if (isset($_POST["pass"])) {
$pass = $_POST["pass"];
}
else {
$pass = "";
}
$query="SELECT * FROM login WHERE username=:username";
$params=(array(':username' => $user));
try{
$stmt = $connection->prepare($query);
$result = $stmt->execute($params);
}
catch(PDOException $ex){
echo ("Failed to run query: " . $ex->getMessage());
}
$fetch = $stmt->fetch();
$passwordfetch=$fetch['password'];
if (password_verify($pass, $passwordfetch)) {
session_start();
$_SESSION['sess_user']=$user;
?>
<meta http-equiv='refresh' content="0; url=http://peopleinvestment.ro/filip/admin.php">
<?php
}
else {
echo "Invalid Information";
}
?>
<center>
<h3>Login</h3>
<form action="" method="POST">
Username: <input type="text" name="user">
Password: <input type="password" name="pass">
<input type="submit" value="Login" name="submit" />
</form>
</body>
</html>
DO NOT CHANGE ANYTHING but the db_password and db_name. Now next thing that you should change. First off if someone ever got in your database your passwords are NOT secure because they are not "hashed". Now you can hash these passwords by doing this right before submitting them into the database:
password_hash($pass, PASSWORD_DEFAULT);
So basically right before the user is about to register it will automatically password_hash, and then input it into the database. Now that MUST be done or else the code above will NOT work. Yet if you choose not to password_hash (bad idea), then you could just use this code: http://pastebin.com/SJisBwnB. That should fix your problems, if any errors are still being raised or if you have any questions please just make another comment! :) This worked perfectly for me.
