1

When correct ID and password is put login.php pages redirects to the home page successfully. Now I want an error message to display on the login.php page when wrong ID or password is entered. here are my codes-

login_save.php

<?php
function SignIn($loginname,$pass) {
include '../../common/common.php';
//require_once '../../common/createdbconn.php';

$login_id='';
$login_status='';
$error_message= '';

if(!empty($loginname) && !empty($pass)){ //checking the 'user' name and password, is it empty or have some text 
  
  $login_id=validate_login($loginname,$pass);  
  if ($login_id != '') {  
  
   header("location:homeaction.php?session_id=".session_id());
  }
  
  else {
   // invalid user check
   $error_message=INVALID_USERNAME;
   //$_SESSION['error_message']=$error_message;
   $login_status=$error_message;
   session_unset();
   session_destroy();
  }  
  }
else {
  //empty check
  $error_message=NO_USERNAME_PASSWORD;
  //$_SESSION['error_message']=$error_message;
  $login_status=$error_message;
 }
 return $login_status;
 
}

function validate_login($loginname,$pass) {
 require '../../common/createdbconn.php';
 // validate user
 $sql="SELECT id, fullname, designation_id from m_user where login_name='$loginname' and password='$pass'";
 //$sql="SELECT mu.id as id, mu.fullname as fullname, mu.office_id as office_id, xurm.role_id as role_id from m_user mu, x_user_role_mapping xurm where mu.id = xurm.user_id and mu.login_name='$loginname' and mu.password='$pass'";
 $result=mysqli_query($conn,$sql);
 $login_id=mysqli_fetch_row($result);
 session_start();
 $sessionid = session_id();
 $sql_sessionid="update m_user set session_id='$sessionid' where login_name='$loginname'";
 $result=mysqli_query($conn,$sql_sessionid);
 $_SESSION['login_id']=$login_id[0];
 $_SESSION['fullname']=$login_id[1];
 $_SESSION['logged_in']=true;
 $_SESSION['loginname']=$loginname;
 return $login_id[0];
} 

?>

login_action.php

<?php  
require_once '../../common/createdbconn.php';
require_once '../model/login_save.php';


$loginname=$_POST["user"];
$password=$_POST["pass"];
$pass=md5($password);
$login_status='';

$login_status=SignIn($loginname,$pass);

if ($login_status=='') { // Validation passed
 session_start(); //starting the session for user profile page  
}

else  {$error ="Username or Password is invalid";
    header("location:../view/login.php?login_status=$login_status");
    session_destroy();
}
?>

login.php

<!DOCTYPE html>

<?php 
require '../../common/createdbconn.php';
?>

<html>
 <head>
 
  <meta charset="UTF-8">
  <title>CBS HELPDESK,ASSAM CIRCLE</title>
  <link rel="icon" href="../../images/IP.png" type="image/png" sizes="100x56">
  <link rel="stylesheet" href="../../css/style.css">
 </head>
 <body>
 <img src="../../images/indiapost.jpg" style="width:1600px;height:120px;">
  <h1>Welcome to Circle Processing Centre-Assam</h1>
  
  
  <div class="wrapper">
   <div class="container">
   
    <h2>Login to Continue</h2>


    <form method="post" action="../controller/login_action.php" class="form">    
     <input id="user" name="user" type="text"  placeholder="Enter Your UserID">
     <input id="pass" name="pass" type="password" placeholder="Enter Your Password">
     <button id="login" name="login"  type="submit">Login</button>
    </form>
   </div>
  </div>
 </body>
</html>
Kunal
  • 41
  • 1
  • 4
  • ***You really shouldn't use [MD5 password hashes](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure)*** and you really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. Make sure you [don't escape passwords](http://stackoverflow.com/q/36628418/1011527) or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Jul 22 '16 at 17:35
  • [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Jul 22 '16 at 17:35

0 Answers0