how to redirect when not logged in php

user_10265190 0
Viewed 387

I have built a PHP login network now in my login form people can log in and if the information is correct then they will be redirected to welcome.php. Now anyone can visit this page directly how can I make this happen that whenever someone is not logged in then they should be redirected to login.php this is my login code

<?php
require_once "config.php";
// Initialize the session
session_start();

// Check if the user is already logged in, if yes then redirect him to welcome page
if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
  header("location: welcome.php");
  exit;
}

// Include config file


// Define variables and initialize with empty values
$username = $password = "";
$username_err = $password_err = "";

// Processing form data when form is submitted
if($_SERVER["REQUEST_METHOD"] == "POST"){

    // Check if username is empty
    if(empty(trim($_POST["username"]))){
        $username_err = "Please enter username.";
    } else{
        $username = trim($_POST["username"]);
    }

    // Check if password is empty
    if(empty(trim($_POST["password"]))){
        $password_err = "Please enter your password.";
    } else{
        $password = trim($_POST["password"]);
    }

    // Validate credentials
    if(empty($username_err) && empty($password_err)){
        // Prepare a select statement
        $sql = "SELECT id, username, password FROM users WHERE username = ?";

        if($stmt = mysqli_prepare($con, $sql)){
            // Bind variables to the prepared statement as parameters
            mysqli_stmt_bind_param($stmt, "s", $param_username);

            // Set parameters
            $param_username = $username;

            // Attempt to execute the prepared statement
            if(mysqli_stmt_execute($stmt)){
                // Store result
                mysqli_stmt_store_result($stmt);

                // Check if username exists, if yes then verify password
                if(mysqli_stmt_num_rows($stmt) == 1){                    
                    // Bind result variables
                    mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password);
                    if(mysqli_stmt_fetch($stmt)){
                        if(password_verify($password, $hashed_password)){
                            // Password is correct, so start a new session
                            session_start();

                            // Store data in session variables
                            $_SESSION["loggedin"] = true;
                            $_SESSION["id"] = $id;
                            $_SESSION["username"] = $username;                            

                            // Redirect user to welcome page
                            header("location: welcome.php");
                        } else{
                            // Display an error message if password is not valid
                            $password_err = "The password you entered was not valid.";
                        }
                    }
                } else{
                    // Display an error message if username doesn't exist
                    $username_err = "No account found with that username.";
                }
            } else{
                echo "Oops! Something went wrong. Please try again later.";
            }
        }

        // Close statement
        mysqli_stmt_close($stmt);
    }

    // Close connection
    mysqli_close($con);
}
?>

I have tried this in welcome.php but not working

<?php
session_start(); 
include 'config.php';

if (empty($_SESSION['user'])) {
    header('Location: index.php');
    exit;
}

?>
redirect authentication php
2 Answers

Since you set session for username during login.

Assuming that you want to protect page welcome.php to ensure that only login users can access it.

copy the code below and paste it at the very top of welcome.php page. You can do the same for any other page that you want to protect and it will work.

The code should be the first thing to be placed at the top of the page eg.welcome.php, dashboard.php etc.

<?php

session_start();
if(!isset($_SESSION['username']) || (trim($_SESSION['username']) == '')) {
        header("location: login.php");
        exit();
    }

?>
user_100707600

In welcome.php you should implement better check of user current state.

Like login page you should check for user cookie which is set in your code by name $_SESSION['loggedin']

To check if user have that cookie and cookie is set to true use this code

if(isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true){
  header("location: login.php");
}
user_117809670
Related