any one help me with this code !!!

[Ajithguru741]

i am trying to built urer registration and user login page

the registration page works perfectly fine.(the enterted data is stored the the database with $hash password)

<?php
 
 
$showError="false";
if($_SERVER["REQUEST_METHOD"] == "POST"){
    include '_dbconnect.php';
 
    $user_email = $_POST['signupemail'];
    $pass = $_POST['signuppassword'];
    $cpass = $_POST['signuppassword'];
 
    // check wether this email exists
 
    $existSql="select * from `users` where user_email = '$user_email'";
    $result = mysqli_query($conn, $existSql);
    $numRows = mysqli_num_rows($result);
    if($numRows>0){
        $showError = "Email already in use";
    } else{
        if($pass == $cpass){
           $hash = password_hash($pass, PASSWORD_DEFAULT);
           $sql =" INSERT INTO `users` ( `user_email`, `user_pass`, `timestamp`) VALUES ('  $user_email', '  $hash', current_timestamp())";
           $result = mysqli_query($conn, $sql);
           if($result){
            $showAlert=true;
            header("Location:/wediscuss%20forum/index.php?signupsuccess=true");
            exit();
           }
        }else{
            $showError ="passwords do not match";  
 
        }
    }
    header("Location:/wediscuss%20forum/index.php?signupsuccess=false&error= $showError ");
}
 
 
 
?>

The problem arises when i try to login . the page gets redirected but the echo is not working ( like printing THIS user is loged in)

<?php
$showError = "false";
if($_SERVER["REQUEST_METHOD"] == "POST"){
  include '_dbconnect.php';
  $email = $_POST['loginEmail'];
  $pass = $_POST['loginPass'];
 
  $sql = "SELECT * FROM `users` where user_email='$email'";
  $result = mysqli_query($conn, $sql);
  $numRows = mysqli_num_rows($result);
  if($numRows==1){
    $row = mysqli_fetch_assoc($result);
    if(password_verify(  $email, $row['user_pass'])){
          session_start();
          $_SESSION['loggedin'] = true;
            $_SESSION['slno'] = $row['slno'];
            $_SESSION['useremail'] = $email;
            echo "loggedin". $email;
 
        } 
        else{
          echo "unable to login";
 
        }
    }
 
 
?>

[bakertaylor28]

 header("Location:/wediscuss%20forum/index.php?signupsuccess=false&error= $showError ");
 

This is your problem - logins are better done by storing a session var:

...
// After checking against database We set session variable to 0 when logged out and 1 when logged in
$_SESSION['login'] === foo;
 
//We then evaluate for login:
if  ($_SESSION['login'] === 1) {
//show pasword protected content 
 header("Location:/protected/content.php");
} elseif ($_SESSION['login'] === 0) {
// deny access
 header("Location:/path/to/static/errorpage.php ");
} else {
die();
}
...
 

We check the session var on every protected page or location. it is important that we use === not == or = in order to prevent code injection, any time we're anywhere around SQL.

[Techii1120]

Based on the given code, the issue seems to be that the header() function is called twice in the code, which is not allowed. Once a header has been sent, no further headers can be sent. In this case, the first header() function is called after the user has been successfully registered, which is fine. However, the second header() function is called after the error message is set, which is causing the issue.


To fix this issue, you can try the following solution:



Remove the second header() function, which is located at the end of the code.


Instead of redirecting the user to the index.php page with an error message in the URL, you can store the error message in a session variable and redirect the user to the index.php page without any error message in the URL.



Here is an updated version of the PHP code:


<?php
session_start();
$showError = false;
if ($_SERVER["REQUEST_METHOD"] == "POST") {
include '_dbconnect.php';

$user_email = $_POST['signupemail'];
$pass = $_POST['signuppassword'];
$cpass = $_POST['signuppassword'];

$existSql = "select * from `users` where user_email = '$user_email'";
$result = mysqli_query($conn, $existSql);
$numRows = mysqli_num_rows($result);

if ($numRows > 0) {
$showError = "Email already in use";
} else {
if ($pass == $cpass) {
$hash = password_hash($pass, PASSWORD_DEFAULT);
$sql = "INSERT INTO `users` (`user_email`, `user_pass`, `timestamp`) VALUES ('$user_email', '$hash', current_timestamp())";
$result = mysqli_query($conn, $sql);
if ($result) {
$_SESSION['signupsuccess'] = true;
header("Location: /wediscuss%20forum/index.php");
exit();
}
} else {
$showError = "Passwords do not match";
}
}

$_SESSION['signupsuccess'] = false;
$_SESSION['error'] = $showError;
header("Location: /wediscuss%20forum/index.php");
exit();
}
?>

In the updated code, the error message is stored in a session variable called error, and the signupsuccess variable is set to either true or false based on whether the user was successfully registered or not. The user is then redirected to the index.php page without any error message in the URL.