PHP if else statement else gives blank screen

Question

I have a problem with my if else statement near the bottom of the code.

If condition is true, it correctly echo logged in and username "super_user" but if condition is false I get a blank screen, it does not echo my fail message "nope"

"super user" and "password" get passed from an html input form in a previous page

I am not sure what I got wrong here, I am really new to PHP.

<?php 
session_start(); 
if ($_POST['Submit2']) {  
    $super_user= $_POST['super_user'];
    $password= $_POST['password']; 

    $db = new mysqli('*******', '******', '*******', '******');

    if($db->connect_errno > 0){
        die('Unable to connect to database [' . $db->connect_error . ']');
    }

    $sql = <<<SQL
    SELECT *
    FROM `admin`
    WHERE password='$password' AND  super_user='$super_user'
    SQL;

    if(!$result = $db->query($sql)){
        die('There was an error running the query [' . $db->error . ']');
    }


    while($row = $result->fetch_assoc()){

        if  (($super_user == $row['super_user'] && $password == $row['password'] )){ 
            echo "logged in "; 
            echo "<br>"; 
            echo $row['super_user']; 
        }
        else
        {
            echo "nope"; 
        }
    }

}
?>

I was trying to make a simple login system that would set a session and redirect back to the home page using something like :

$_SESSION['loggedin'] = $super_user;
header("Location:index.php");
exit;

But before I even do that I wanted to just echo the username "super_user" to see if my if else statement was working.

Regardless of the error - you need to read up on SQL injection - http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php — Laurence, Jul 23 '14 at 11:43
You're new and you have a blank page. I guess this i for you: [How to get useful error messages in PHP ?](http://stackoverflow.com/a/845025/3361444) — Debflav, Jul 23 '14 at 11:47

Laurence · Accepted Answer · 2014-07-23T11:56:54.790

0

The problem is if you run a false query, you will never enter the while loop (Because it will not match a user/password in the first place, so your sql query will not return any results/rows).

So your code skips the while loop.... and then just ends - hence a 'white' page.

Just add a message at the end:

if  ($result->rowCount > 0)
{
    while($row = $result->fetch_assoc()){

        if  (($super_user == $row['super_user'] && $password == $row['password'] )){ 
            echo "logged in "; 
            echo "<br>"; 
            echo $row['super_user']; 
        }
        else
        {
            echo "nope"; 
        }
    }
}
else
{
    echo 'no matching user found';
}

edited Jul 23 '14 at 11:56

answered Jul 23 '14 at 11:48

Laurence

58,936
21
171
212

This will always end up echoing that no matching user was found, whether he's found or not (along with the additional information if found). Correct me if I'm wrong, I'll grab a double espresso if that's the case. – Jonast92 Jul 23 '14 at 11:50
1

Yeah - I think I need the double espresso :) – Laurence Jul 23 '14 at 11:54
Your awesome! ;) As I said I am new to this but this example did work. – Dan Jul 23 '14 at 12:01

Alexander Gelbukh · Answer 2 · 2014-07-23T11:55:56.217

Your SQL query retrieves all rows with the given username and password. Either there is (exactly) one or there is none. So your if() will be always true if there is one, and will never execute if there is none because your while will be executed 0 times.

Rather you can use

$found = 0;

while ($row = $result->fetch_assoc())
{
    $found = 1;
}

if ($found)
    echo "Logged in";
else
    echo "nope";

or simpler:

if ($result->fetch_assoc())
    echo "Logged in";
else
    echo "nope";

PHP if else statement else gives blank screen

2 Answers2