User is logged in, but not re-directed

Question

I have a login script written in PDO. When the user logs in, they're supposed to be re-directed to index.php. Instead though, they stay on the same page.

<?php

$db_username = "user";
$db_password = "pass";
$con = new PDO("mysql:host=localhost;dbname=db", $db_username, $db_password);

if(isset($_POST['submit'])) {

$username = $_POST['username'];
$password = md5($_POST['password']);

$logincheck = $stmt = $con->prepare("SELECT * FROM users WHERE username=:username and password=:password");
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();
$rows = $stmt->fetch(PDO::FETCH_NUM);
if($rows > 0) {
header('Location: index.php');
}
}
?>

<form method="post">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit" name="submit">
</form>

Answer 1

1. Change if(isset($_POST['submit'])) to if(isset($_POST['username']) && isset($_POST['password']) )

   because submit type can't be send by form

2. Be sure about hashing algorithm

3. change exit(header('Location: index.php')); to header('Location: http:// www.example.com/index.php');

   Because exit(); is not suitable and here is the syntax error.

header must be sent separately and after that execution of that page already exited.

I am considering $con variable is pre set and there is no any error on SQL fetch. Also PDO database logging is missing in your code. And so many error may possible.

use error reporting on in php.ini file to track what actually happens

Answer 2

I've had this problem recently working on a project and the only thing that comes to my mind is:

"**Warning:** Cannot modify header information - headers already sent (output started at /htdocs/your_project_name/your_file.php:X, where X is the line number)."

Double check your errors; insert this somewhere on top in the script you are using to process the form submission:

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

I was able to get it to work by doing this:

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

if ((isset($_POST['username']) && !empty($_POST['username'])) &&
  (isset($_POST['password']) && !empty($_POST['password']))) {
  //echo $_POST['username'];
  //echo $_POST['password'];
  // these statements are commented out because they were
  // displaying information before the header('Location: index.php') 
  // was called, uncomment this and try to see what I am talking about

  $username = $_POST['username'];
  $password = $_POST['password'];

  $db_username = 'root';
  $db_password = 'root';
  // always use try-catch when working with databases, api's, etc.
  try
  {
     $dbconn = new PDO('mysql:host=localhost;dbname=db', $db_username, $db_password);

    $stmt = $dbconn->prepare('SELECT * FROM users WHERE username=:username AND
    password=:password LIMIT 1');
    $stmt->bindParam(':username', $username);
    $stmt->bindParam(':password', $password);

    $stmt->execute();

    if ($stmt->rowCount() > 0)
    {
      header('Location: index.php');
    }
  }
  catch (PDOException $e)
  {
    echo 'Database error: ' . $e->getMessage();
  }
}

Obviously, the form doesn't change, except that I added the action attribute:

<form method="post" action="submit.php">
<!--form fields-->
</form>

Obviously, make sure you are storing users passwords securely. I didn't hash my password before I checked the database but you should always sanitize any input that gets submitted from a form. Take a look here

• phpsec.org/projects/guide/1.html#1.4

and here

• php.net/manual/en/function.password-hash.php

And this in particular, as you would then use this function to check whether the password matches:

http://php.net/manual/en/function.password-verify.php

If you are still having problems and the headers already sent issue is the problem, check out this post:

How to fix "Headers already sent" error in PHP