Displaying a Username or Password Feedback Message using PHP

Question

I need to have messages show up when an invalid username or password is entered.

I have it set up so that when something happens, it redirects the page back to the index.php page, but with ?message=Bad_Username or ?message=Bad_Password added.

I also have an if statement set up so that I can get the message to print below the username or password fields when certain conditions are met.

I am just not certain what the If statement condition needs to be for it to work.

Here's the code.

if (($_GET['username'])){
    echo "<p class='help is-danger'>This username is invalid</p>";
    if(header("location: index.php?message=Bad_Username")){
        echo "<p class='help is-danger'>This username is invalid</p>";
    }
}

Answer 1

If you receive something in get, it means that the username is incorrect. If you do not receive anything it means that the user has not yet tried to connect.

Just simply do this in your login page (where you have your form):

if ($_GET['message']==Bad_UserName) {
        echo "<p class='help is-danger'>This username is invalid</p>";
    }

If you want to do this for both username and password you can do this:

if ($_GET['message']==Both_Bad) {
    echo "<p class='help is-danger'>This username and password 
          are invalid</p>";
}
if ($_GET['message']==Bad_Username) {
    echo "<p class='help is-danger'>This username is invalid</p>";
}
if ($_GET['message']==Bad_Password) {
    echo "<p class='help is-danger'>This password is invalid</p>";
}

And this is an example for your login processing:

$user="user1"; //user example
$pass="1234"; //pass example

//method post or get (depends on your form method)
$inputUser = filter_var($_POST['user'], FILTER_SANITIZE_STRING);
$inputPass = filter_var($_POST['pass'], FILTER_SANITIZE_STRING);

if($inputUser!=$user && $inputPass!=$pass){
    header("location: index.php?message=Both_Bad");
}elseif ($inputUser!=$user) {
    header("location: index.php?message=Bad_Username");
}elseif ($inputPass!=$pass) {
    header("location: index.php?message=Bad_Password");
}else{
    $_SESSION['user'] = $inputUser //can be the login, id of the user or something else
    header("location: MyNextPage.php");
}

Login Page and Login Processing are seperated into two files