登录 PHP：用户级别使用 MYSQL 在单页登录

Question

sorry if what I'm about to ask is something really basic, but I've been stuck on this for two weeks.

I have a login page where User can login to my website. Different user's role will be prompt to different pages. Now, the login is fine, but when my user key in wrong password or username, there's no warning triggered and user stays on the blank login.php page when user supposed to be redirected back at index.php and warning is triggered.

Below is my code

login form (index.php)

 <div class="login-box-body"> <form method="post" action="login.php"> <div class="form-group has-feedback"> <input type="username" name="username" class="form-control" placeholder="Username"> <span class="glyphicon glyphicon-user form-control-feedback"></span> </div> <div class="form-group has-feedback"> <input type="password" name="password" class="form-control" placeholder="Password"> <span class="glyphicon glyphicon-lock form-control-feedback"></span> </div> <div class="row"> <div class="col-xs-8"> </div> <.-- /.col --> <div class="col-xs-4"> <button class="btn btn-primary btn-block btn-flat" type="submit" name="login" value="true">Sign In</button> </div> <!-- /.col --> </div> </form> </div>

and here my back end script (login.php)

 <?php session_start(); $conn=mysqli_connect('localhost','root','','snapshot'); //Getting Input value if(isset($_POST['login'])){ $username=mysqli_real_escape_string($conn,$_POST['username']); $password=mysqli_real_escape_string($conn,$_POST['password']); if(empty($username)&&empty($password)){ $error= 'Fields are Mandatory'; }else{ //Checking Login Detail $result=mysqli_query($conn,"SELECT*FROM user WHERE username='$username' AND password='$password'"); $row=mysqli_fetch_assoc($result); $count=mysqli_num_rows($result); if($count==1){ $_SESSION['user']=array( 'id' =>$row['id'], 'username'=>$row['username'], 'uname'=>$row['uname'], 'password'=>$row['password'], 'role'=>$row['role'] ); $role=$_SESSION['user']['role']; //Redirecting User Based on Role switch($role){ case 'user': header('location:user/dashboard.php'); break; case 'management': header('location:management/index.php'); break; case 'admin': header('location:admin/index.php'); break; } }else{ $error='Your PassWord or UserName is not Found'; } } }?>

and before asking I already read few similar questions and find no solutions. Thank you in advance for the help.

Answer 1

At the end of login.php you're setting the value of $error to Your PassWord or UserName is not Found - however nothing further is happening.

Your switch that redirects the user only comes into play if the user is found in the database, on a side note here you should be encrypting the users password and comparing the hashes.

To solve your issue, try doing something like the following:

} else {
 $error='Your PassWord or UserName is not Found';
 header('location:login.php?error=' . $error);
}

Then in your login form you can simply check for the error message and display it:

<?php if(isset($_GET['error'])): ?>
<div><?= $_GET['error'] ?></div>
<?php endif ?>