login page php and javascript

[leesyaa]

I'm working on a login page by user level. but it didnt seems to work. it doesnt redirect and leave a blank page.

index.php (where the form at)

<form class="login" action="login.php" method="post">
&nbsp;&nbsp;<b>Username:</b>&nbsp;<input type="text" name="username" id="username"/>&nbsp;&nbsp;
<b>Password:</b>&nbsp;<input type="password" name="password" id="password"/>
&nbsp;<input type="submit" value="login" onClick="return check()"/>
</form>

login.php

<?php 
 
    include('config.php');
    session_start();
 
 
if(isset($_POST['submit'])) {
 
    $username = $_POST['username'];
    $password = $_POST['password'];
 
        $username = mysql_real_escape_string($username);    
        $password = mysql_real_escape_string($password);
 
        $sql = mysql_query("SELECT * FROM admin WHERE username='$username' and password='$password'");
        $result = mysql_fetch_array($sql);
 
        $username=$result['username'];
        $adminID=$result['adminID'];
        $userLevel=$result['userLevel'];
 
        $_SESSION['adminID']=$adminID;
        $_SESSION['userLevel']=$userLevel;
        $_SESSION['username']=$username;
        $_SESSION['password']=$password;
 
        if($userLevel=="1")
        {
        ?>
        <script languange='JavaScript'>
        alert("Welcome <?php echo "$username" ?> to Admin Page! ");
 
        <?php
 
         $sql = "UPDATE admin SET status = 'AKTIF' where username = '$username' ";
         $result = mysql_query($sql) or die('Cannot UPDATE.'.mysql_error());
 
         echo"<meta http-equiv='refresh' content='0; URL=admin.php'>";
        }
 
        else if($userLevel=="0")
        {
        ?>
        <script languange='JavaScript'>
        alert("Welcome <?php echo "$username" ?> to User page! ");
 
        <?php
 
        $sql = "UPDATE admin SET status = 'AKTIF' where username = '$username' ";
        $result = mysql_query($sql) or die('Cannot UPDATE.'.mysql_error());
 
        echo"<meta http-equiv='refresh' content='0; URL=user.php'>";
        }
        else
        {
            echo "<script>";
            echo "alert(Invalid username or password.')";
            echo "</script>";
        }
 
    }
?>

did I miss something? :/

[koharu]

Since you have no validation, one can assume that there could be an issue with your SQL Query, or the data being sent to your SQL Query. Turn on Error Reporting (error_reporting('E_ALL'); and ensure you have proper levels of validation applied to your query to ensure your query is returning data.

Also, your page will only display if something is posted to it, if nothing is posted to the page, it will display a blank page.