0

This is my first time using a template. I'm a beginner.

Since I used adminlte template my codes stop working properly.

HTML Code:

<!DOCTYPE html>
enter code here<?php
session_start();
?>
  <html>
  <head>
  <meta charset="UTF-8">
  <title>Admin Panel | Log in</title>
  <!-- Tell the browser to be responsive to screen width -->
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <!-- Bootstrap 3.3.6 -->
  <link rel="stylesheet" href="bootstrap/css/bootstrap.min.css">
  <!-- Font Awesome -->
   <link rel="stylesheet" href="font-awesome/font-awesome-2/css/font-awesome.min.css">
  <!-- Ionicons -->
   <link rel="stylesheet" href="ionicons/ionicons2/css/ionicons.min.css">
  <!-- Theme style -->
  <link rel="stylesheet" href="dist/css/AdminLTE.min.css">
  <!-- iCheck -->
  <link rel="stylesheet" href="plugins/iCheck/square/blue.css">


  <style type="text/css">
  .img-bg-mine{
    background: url('images/loginbg.jpg') no-repeat center center fixed; background-size: cover;
  }
  </style>

  <!-- HTML5 Shim and Respond.js IE8 support of HTML5 elements and media queries -->
  <!-- WARNING: Respond.js doesn't work if you view the page via file:// -->
  <!--[if lt IE 9]>
  <script src="https://oss.maxcdn.com/html5shiv/3.7.3/html5shiv.min.js"></script>
  <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
  <![endif]-->

</head> 
<body class="hold-transition login-page img-bg-mine">
<div class="login-box">
  <div class="login-logo">
    <a href="index.php"><b>Student</b> Evaluation</a>
  </div>
  <!-- /.login-logo -->
  <div class="login-box-body">
    <p class="login-box-msg">Sign in to start your session</p>

    <form action="login.php" method="post">
      <div class="form-group has-feedback">
          <div class="input-group">
                <input type="text" class="form-control" placeholder="Enter Your Username"  name="login_username" id="login_username">
                <span id="errorUsername"></span>    
                <span class="input-group-addon">
                <i class="fa fa-user"></i>
                </span>
          </div>
       </div>
      <div class="form-group has-feedback">
      <div class="input-group">
                <input type="password" class="form-control" placeholder="Enter Your Password"  name="login_password" id="login_password">
                 <span id="errorPassword"></span>   
                <span class="input-group-addon">
                <i class="fa fa-lock"></i>
                </span>
          </div>
      <br>
      <div class="row">
      <div class="col-xs-12">
          <button type="submit" class="btn bg-olive btn-flat pull-right btn-lg" name="login" id="login">Sign In</button>
      </div>
      </div>
    </form>

    </div>
  <!-- /.login-box-body -->
</div>
  <!-- jQuery 2.2.3 -->
 <script src="plugins/JQuery/jquery-2.2.3.min.js"></script>
<!-- Bootstrap 3.3.6 -->
 <script src="bootstrap/js/bootstrap.min.js"></script>

</body>
</html>

PHP Code:

<?php
include 'dbcon.php';
?>

<?php
if(isset($_POST['login'])){

$username = mysqli_real_escape_string($conn,$_POST['login_username']);
$password = mysqli_real_escape_string($conn,$_POST['login_password']);
//select user from database
$select_user = "SELECT * from tb_admin where admin_user='$username' and admin_pass='$password'";
//run query
$login =mysqli_query($conn,$select_user);
$count =mysqli_num_rows($login);
$row= mysqli_fetch_array($login);

if ($count > 0){
session_start();
$_SESSION['id']=$row['admin_id'];
echo "<script>window.open('adminpanel.php','_self')</script>";// this part  is not working it only shows the word window.open('adminpanel.php','_self') instead of showing the page adminpanel.php
}else
{
echo "<script>alert('Login failed..')</script>";// same here
echo "<script>window.open('index.php','_self')</script>";// same here
}
}

?>

It looks like my script in login.php is not working. It just shows the text nothing more.

Community
  • 1
  • 1
Noob Noob
  • 1
  • 2
  • 4
    **Never store plain text passwords!** Please use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). Make sure you ***[don't escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. – Jay Blanchard Feb 27 '17 at 20:44
  • 1
    [Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)*** Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! [Don't believe it?](http://stackoverflow.com/q/38297105/1011527) – Jay Blanchard Feb 27 '17 at 20:44
  • 1
    **WARNING**: Writing your own access control layer is not easy and there are many opportunities to get it severely wrong. Please, do not write your own authentication system when any modern [development framework](http://codegeekz.com/best-php-frameworks-for-developers/) like [Laravel](http://laravel.com/) comes with a robust [authentication system](https://laravel.com/docs/5.4/authentication) built-in. At the absolute least follow [recommended security best practices](http://www.phptherightway.com/#security) and **never store passwords as plain-text**. – tadman Feb 27 '17 at 21:48
  • im going to change my script later. Guys kindly tell me why it doesnt work? When i clicked login even though the user and password i entered is correct the result is this "window.open('admin_panel.php','_self')". It doesnt open the admin_panel.php instead it only displays the text :( – Noob Noob Mar 02 '17 at 16:49
  • why don't you just use the PHP "header" command with "Location" to redirect to the correct page instead of trying to inject script into the returned markup? You're just causing the user's browser to make an extra, unnecessary request. See http://stackoverflow.com/questions/768431/how-to-make-a-redirect-in-php – ADyson Mar 05 '17 at 19:58
  • i already solved the problem :) i guess i just have some minor errors in the connection of my database. Ty guys for your suggestions! – Noob Noob Mar 06 '17 at 13:42

0 Answers0