登录到php后重定向页面

Question

I am new to php and I googled a simple login form with source code in it. The code was working but it wont redirect me to home page rather it stay still in login page. Here is the code for the authentication that is responsible for redirection if user inputs correct credentials:

ob_start();
session_start();
$error='';
if(isset($_POST['submit'])){
if(empty($_POST['username']) || empty($_POST['password'])){
    $error="Username or Password is invalid";
}
else{
    $username=$_POST['username'];
    $password=$_POST['password'];

    $cxn=mysql_connect("localhost","root","admin"); 
    $username=stripslashes($username);
    $password=stripslashes($password);
    $username=mysql_real_escape_string($username);
    $password=mysql_real_escape_string($password);

    $db=mysql_select_db("hrdb",$cxn);
    $query=mysql_query("select * from login where Username='$username' AND 
    Password='$password'",$cxn);

    $rows=mysql_num_rows($query);
    if($rows==1){
        $_SESSION['log_user']=$username;
        echo "test";
        header('Location: http://localhost/HRMS/profile.php');
        exit;
    }else{
        $error="Username or password is invalid";
    }
    mysql_close($cxn);
    }
    }
    ob_end_flush();

Answer 1

You can use the header() function to send a new HTTP header, but this must be sent to the browser before any HTML or text (so before the declaration, for example).

You may want to include die after the header call:

header("Location: http://localhost/HRMS/profile.php");
die();

Answer 2

I will suggest you to use mysqli instead of mysql and there are minor changes please check it carefully and test the code it is working fine now.

    ob_start();
    session_start();
    $error='';


    if(isset($_POST['submit'])){
        if(empty($_POST['username']) || empty($_POST['password'])){
            $error="Username or Password is invalid";
        }
        else{
            $username=$_POST['username'];
            $password= md5($_POST['password']);

            $cxn= mysqli_connect("localhost","root","","hrdb");
            $username=stripslashes($username);
            $password=stripslashes($password);
            $username=mysqli_real_escape_string($cxn,$username);;
            $password=mysqli_real_escape_string($cxn,$password);;

            $query=mysqli_query($cxn,"select * from user_mst_tbl where USER_NAME='".$username."' AND
            PASS_WORD='".$password."'");

            $rows=mysqli_num_rows($query);
            if($rows==1){
                $_SESSION['log_user']=$username;
                echo "test";
                header('Location: http://localhost/HRMS/profile.php');

            }else{
                $error="Username or password is invalid";
            }
            mysql_close($cxn);
        }
    }
    ob_end_flush();

Answer 3

You are receiving the error:

Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead

because you have installed a later version of XAMPP.

You need to consider using prepared statement rather than the deprecated mysql_* API. You don't need to sanitize each variables before you can use it in your queries, because prepared statement will do it for you.

And if you are going to use header() function of PHP, make sure that you don't have any output before you call header() .

Check also your profile.php , if it has header() call too, which redirects the page back to the login page.

<?php

/* MAKE SURE THAT THERE ARE NO HTML/OUTPUTS ABOVE THIS CODE */

ob_start();
session_start();
$error = "";

/* ESTABLISH CONNECTION */
$con = new mysqli("localhost", "root", "admin", "hrdb");

/* CHECK CONNECTION */
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}

if(isset($_POST['submit'])){

  if(empty($_POST['username']) || empty($_POST['password'])){
    $error="Username or Password is invalid";
  }
  else{

    if($stmt = $con->prepare("SELECT Username FROM login WHERE Username = ? AND Password = ?")){ /* CHECK AND PREPARE THE QUERY */
      $stmt->bind_param("ss",$_POST["username"],$_POST["password"]); /* BIND THESE VARIABLES TO YOUR PREPARED QUERY; s STANDS FOR STRINGS */
      $stmt->execute(); /* EXECUTE THE QUERY */
      $rows = $stmt->num_rows; /* GET NUMBER OF ROWS/RESULTS */
      if($rows == 1){ /* IF FOUND RESULT */
        $stmt->bind_result($username); /* STORE THE RESULT TO THIS VARIABLE */
        $stmt->fetch(); /* FETCH THE RESULT */
        $_SESSION['log_user'] = $username; /* STORE THE RESULT TO THIS SESSION VARIABLE */
        /* header('LOCATION: http://localhost/HRMS/profile.php'); REDIRECT THE PAGE TO profile.php */
        ?>
          <meta http-equiv="refresh" content=".5; URL='profile.php'"/> <!-- REDIRECT TO profile.php IN HALF A SECOND -->
        <?php
      }
      else {
        $error="Username or password is invalid";
      }
      $stmt->close();
    } /* END OF PREPARED STATEMENT */

  } /* END OF ELSE */

} /* END OF ISSET SUBMIT */

ob_end_flush();

?>

You should also secure the password being stored in your database. You can use password_hash() for it.