header function trouble in hosting

Question

I'm programming a simple login system. It runs very good in local, but when i run in my hosting i'm getting troubles with the header function.

Heres my login form:

<form method="post" action="auth.php">
                User:<br />
                <input type="text" name="name" required><br /><br />
                Password:<br />
                <input type="password" name="pass" class="input" required><br /><br />
                <button>LOGIN</button>

</form>

And the "auth.php":

include '../conection.php';

$user = $mysqli->real_escape_string($_POST['name']);
$pass = sha1($mysqli->real_escape_string($_POST['pass']));

if(isset($user)){

$users = $mysqli->query("select * from admins where admin_user='".$user."' and admin_pass='".$pass."' ");

if($users->fetch_object()){
        session_start();
        $_SESSION['user'] = $user;
        //Im having troubles with this function
        header('Location:control.php');
        exit;

}else{
    echo 'Sorry no access<br /><br />';
    //if i remove the "//" to the next header function works in local and hosting
    //header('Location:index.php');
} 

}else{
echo 'Sorry no access<br /><br />';
 }

$mysqli->close();

WARNINGS: 1st: session_start(): Cannot send session cache limiter. 2nd: Cannot modify header information.

Whats wrong in the code? Or what i'm not considering? Also if you have any advice to improve this code, I really appreciate.

For your help, thanks.

Answer 1

The header() function sends a raw HTTP header to a client.

It is important to notice that header() must be called before any actual output is sent

Answer 2

Use the code that follows, I've put the code to run all on its own, by changing the action to action="" and adding an isset() to a new submit button. You can split them up afterwards.

Don't use <button>LOGIN</button> with the if(isset($_POST['submit'])) conditional statement, it won't work. It is based on the new submit button I've included below.

To first outline the errors:

if($us = $users->fetch_object()) - $us is a stray variable that is not doing anything; it needs to be removed.

The line needs to read as if($users->fetch_object())

The following also needs to be removed; there isn't a corresponding if condition for it:

else{
echo 'Sorry no access<br /><br />';
 }

You're already stating it in: (but don't use echo with header)

else{
    echo 'Sorry no access<br /><br />';
    //if i remove the "//" to the next header function works in local and hosting
    header('Location:index.php');
}

In regards to headers already sent that is caused by the echos and header, plus check to see if you may have a space before your opening <?php tag, or a byte order mark (save your files as UTF-8 without BOM). That could be a contributing factor, should you still get that error after removing the echos.

Make sure there is nothing above it. You can probably get away using ob_start(); following your opening <?php tag.

The echo $user is causing this, so just remove it and use the header. Keep echo to TEST with only, but comment out the header when doing so. You should not be echoing anything above header, HTML, etc.

This echo 'Sorry no access<br /><br />'; is where you should remove it. It's either echo or header, you can't use both.

You can read up on the headers already sent here:

• How to fix "Headers already sent" error in PHP

Code: (see comments in code)

<?php

include '../conection.php';

$user = $mysqli->real_escape_string($_POST['name']);
$pass = sha1($mysqli->real_escape_string($_POST['pass']));

    if(isset($_POST['submit'])){

    $users = $mysqli->query("select * from admins where admin_user='".$user."' and admin_pass='".$pass."' ");

    if($users->fetch_object()){
            session_start();
            $_SESSION['user'] = $user;
            //Im having troubles with this function
            header('Location:control.php');
              exit;

    // echo $user; // don't use this with header

    }else{
        // echo 'Sorry no access<br /><br />'; // don't use this with header
        //if i remove the "//" to the next header function works in local and hosting
        header('Location:index.php');
        exit;
    } 


} // brace for if(isset($_POST['submit']))

$mysqli->close();

?>

<form method="post" action="">
                User:<br />
                <input type="text" name="name" required><br /><br />
                Password:<br />
                <input type="password" name="pass" class="input" required><br /><br />
                <input type="submit" name="submit" value="Submit">
<br>

</form>

Answer 3

To start with use prepared statements Here

Second do this:

header('Location: control.php');
exit;