I am trying to create a simple login form using php and mysql. My code does not display any errors so I suppose the login is successful however it does not redirect me to the next paged (dashboard.php). The sql script of my database table and my php code can be found below.
My login.php code
<?
include('header.php');
include('connect.php');
//Initialize the session
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
// Include config file
require_once "config.php";
// Check if the user is already logged in, if yes then redirect him to welcome page
if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
if ($_SESSION["type"] == "ADMIN") { //check usertype
header("Location: dashboard.php"); //if normal user redirect to dashbord.php
exit();
} else if ($_SESSION["type"] == "ACCOUNTANT") {
header("Location: dashboard.php"); //if accountant user redirect to empty.php
exit();
} else if ($_SESSION["type"] == "MANAGER") {
header("Location: dashboard.php"); //if manager user redirect to admin.php
exit();
}
}
// Define variables and initialize with empty values
$username = $password = "";
$username_err = $password_err = "";
// Processing form data when form is submitted
if ($_SERVER["REQUEST_METHOD"] == "POST") {
// Check if username is empty
if (empty(trim($_POST["username"]))) {
$username_err = "Please enter username.";
} else {
$username = trim($_POST["username"]);
}
// Check if password is empty
if (empty(trim($_POST["password"]))) {
$password_err = "Please enter your password.";
} else {
$password = trim($_POST["password"]);
}
// Validate credentials
if (empty($username_err) && empty($password_err)) {
// Prepare a select statement
$sql = "SELECT id, fname, username, password, type FROM users WHERE username = ?";
if ($stmt = mysqli_prepare($link, $sql)) {
// Bind variables to the prepared statement as parameters
mysqli_stmt_bind_param($stmt, "s", $param_username);
// Set parameters
$param_username = $username;
// Attempt to execute the prepared statement
if (mysqli_stmt_execute($stmt)) {
// Store result
mysqli_stmt_store_result($stmt);
// Check if user exists, if yes then verify password
if (mysqli_stmt_num_rows($stmt) == 1) {
// Bind result variables
mysqli_stmt_bind_result($stmt, $id, $fname, $username, $hashed_password, $type);
if (mysqli_stmt_fetch($stmt)) {
if (password_verify($password, $hashed_password)) {
// Password is correct, so start a new session
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
// Store data in session variables
$_SESSION["loggedin"] = true;
$_SESSION["id"] = $id;
$_SESSION["fname"] = $fname;
$_SESSION["username"] = $username;
$_SESSION["type"] = $type;
// Redirect user to welcome page
if ($_SESSION["type"] == "ADMIN") { //check usertype
header("Location: dashboard.php");
exit();
} else if ($_SESSION["type"] == "ACCOUNTANT") {
header("Location: dashboard.php");
exit();
} else if ($_SESSION["type"] == "MANAGER") {
header("Location: dashboard.php");
exit();
}
} else {
// Display an error message if password is not valid
$PASSWORD_err = "The password you entered was not valid.";
}
}
} else {
// Display an error message if username doesn't exist
$username_err = "No account found with that username.";
}
} else {
echo "Something went wrong. Please try again later.";
}
// Close statement
mysqli_stmt_close($stmt);
}
}
// Close connection
mysqli_close($link);
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login</title>
<link rel="stylesheet" href="assets/css/style.css">
</head>
<body>
<div class="login-container">
<div class="login-form">
<h3>Login</h3>
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
<div class="form-container">
<label for="username">Username</label>
<div class="input-container">
<input type="text" name="username" placeholder="username" class="text-input"/>
<img src="assets/img/svg/icon-user.svg" alt="user icon">
</div>
</div>
<div class="form-container">
<label for="password">Password</label>
<div class="input-container">
<input type="password" name="password" placeholder="password" class="text-input"/>
<img src="assets/img/svg/icon-password.svg" alt="password icon">
</div>
</div>
<div class="btn-container">
<input type="submit" class="login-btn" value="Login">
</div>
</form>
</div>
</div>
</body>
</html>
My config.php code
<?php
/* Database credentials. Assuming you are running MySQL
server with default setting (user 'root' with no password) */
define('DB_SERVER', 'localhost');
define('DB_USERNAME', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', 'erp_system');
/* Attempt to connect to MySQL database */
$link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
// Check connection
if($link === false){
die("ERROR: Could not connect. " . mysqli_connect_error());
}
?>
My header.php code
<?php
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
?>
<!DOCTYPE html>
<html lang="zxx">
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Login</title>
<link rel="stylesheet" href="assets/css/style.css">
</head>
<body>
<?php
if (session_status() == PHP_SESSION_NONE) {
session_start();
}
?>
My connect.php code
<?php
$servername = "localhost";
$username = "";
$password = "";
$dbname = "erp_system";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
Table SQL Scirpt
CREATE TABLE `users` (
`id` int(11) NOT NULL,
`fname` varchar(45) NOT NULL,
`username` varchar(45) NOT NULL,
`password` varchar(45) NOT NULL,
`type` varchar(45) NOT NULL,
`created_at` date NOT NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;