[SOLVED] my login page doesn't redirect Help!

[sasori]

i don't know why is my code not redirecting to "loggedin.php" , i don't see anything wrong with it, please have a look at my code,.you might see errors that is not familiar to my eyes. thanks

<?php
//send nothing to browser prior to setcookie

function escape_data($data){
  global $dbc;
  if(ini_get('magic_quotes_gpc')){
    $data = stripslashes($data);
  }else{
    return mysql_real_escape_string(trim($data),$dbc);
  }
}


if(isset($_POST['submitted'])){
  require_once('./includes/mysql_connect.php');
  $errors = array();

  if(empty($_POST['email'])){
    $errors[] = 'You forgot to enter your email address!';
  }else{
    $e = escape_data($_POST['email']);
  }

  //check password

  if(empty($_POST['password'])){
    $errors[] = 'You forgot to enter your password';
  }else{
    $p = escape_data($_POST['password']);
  }

  if(empty($errors)){//if everything is ok
    //retrieve user_id,first_name
    $sql = "SELECT user_id, first_name FROM users WHERE email='$e' AND password1 =SHA('$p')";
    $result = mysql_query($sql) or die (mysql_error());
    $row = mysql_fetch_array($result,MYSQL_NUM) or die (mysql_error());
    if($row){

        setcookie('user_id',$row[0]);
        setcookie('first_name',$row[1]);
        //redirect user to loggedin.php page
        $url = 'http://'. $_SERVER['HTTP_HOST'] .dirname($_SERVER['PHP_SELF']);
        if((substr($url, -1 )== '/') || (substr($url, -1)== '\\')){
          $url = substr($url,0,-1);
        }
        $url .= '/loggedin.php';

        header("Location: $url");
        exit();
    }else{
      $errors[] = 'The email address and password did not match those file';
      //public message
      $errors[] = mysql_error() . '<br /><br />Query: '. $sql;
    }

  }//end if empty errors
mysql_close();
}else{   //end of main submit conditionals
$errors = NULL;
}
$page_title = 'Login';
require('./includes/header.html');
if(!empty($errors)){
  echo '<h1 id="mainhead">Error!</h1>
        <p class="error">The following error(s) occurred: <br />';
        foreach($errors as $msg){
          echo " - $msg<br />\n";
        }
        echo '</p><p>Please try again.</p>';
    }
?>

<!--create form-->
<h2>Login</h2>
<form action="login.php" method="post">
    <p>Email address: <input type="text" name="email" size="20" maxlength="40"/></p>
    <p>Password: <input type="password" name="password" size="20" maxlength="20" /></p>
    <p><input type="submit" name="submit" value="login" /></p>
    <p><input type="hidden" name="submitted" value="TRUE" /></p>
</form>
<?php
require('./includes/footer.html');
?>

 

[Ken2k7]

In your function escape_data, should it return anything in the if statement?

[sasori]

nope..that's just the way it is, i guess there's no problem with my escape_data function...but with my header? i don't really know where the problem is

[Ken2k7]

It shouldn't be that way. It should return $data after you stripslashes it and perhaps trim it right?

 

Can you put an echo above your header() to see if it echos out?

[sasori]

which/what should i echo on top of the header sir?

[Ken2k7]

Tell me if anything shows up.

 

<?php
//send nothing to browser prior to setcookie

function escape_data($data){
  global $dbc;
  if(ini_get('magic_quotes_gpc')){
    $data = stripslashes($data);
  }else{
    return mysql_real_escape_string(trim($data),$dbc);
  }
}


if(isset($_POST['submitted'])){
  require_once('./includes/mysql_connect.php');
  $errors = array();

  if(empty($_POST['email'])){
    $errors[] = 'You forgot to enter your email address!';
  }else{
    $e = escape_data($_POST['email']);
  }

  //check password

  if(empty($_POST['password'])){
    $errors[] = 'You forgot to enter your password';
  }else{
    $p = escape_data($_POST['password']);
  }

  if(empty($errors)){//if everything is ok
    //retrieve user_id,first_name
    $sql = "SELECT user_id, first_name FROM users WHERE email='$e' AND password1 =SHA('$p')";
    $result = mysql_query($sql) or die (mysql_error());
    $row = mysql_fetch_array($result,MYSQL_NUM) or die (mysql_error());
    if($row){

        setcookie('user_id',$row[0]);
        setcookie('first_name',$row[1]);
        //redirect user to loggedin.php page
        $url = 'http://'. $_SERVER['HTTP_HOST'] .dirname($_SERVER['PHP_SELF']);
        if((substr($url, -1 )== '/') || (substr($url, -1)== '\\')){
          $url = substr($url,0,-1);
        }
        $url .= '/loggedin.php';
        echo 'e';
        header("Location: $url");
        echo 'k';
        exit();
    }else{
      echo 'j';
      $errors[] = 'The email address and password did not match those file';
      //public message
      $errors[] = mysql_error() . '<br /><br />Query: '. $sql;
    }

  }//end if empty errors
mysql_close();
}else{   //end of main submit conditionals
$errors = NULL;
}
$page_title = 'Login';
require('./includes/header.html');
if(!empty($errors)){
  echo '<h1 id="mainhead">Error!</h1>
        <p class="error">The following error(s) occurred: <br />';
        foreach($errors as $msg){
          echo " - $msg<br />\n";
        }
        echo '</p><p>Please try again.</p>';
    }
?>

<!--create form-->
<h2>Login</h2>
<form action="login.php" method="post">
    <p>Email address: <input type="text" name="email" size="20" maxlength="40"/></p>
    <p>Password: <input type="password" name="password" size="20" maxlength="20" /></p>
    <p><input type="submit" name="submit" value="login" /></p>
    <p><input type="hidden" name="submitted" value="TRUE" /></p>
</form>
<?php
require('./includes/footer.html');
?>

[sasori]

I added those echo stuffs in the code,it didn't showed those characters, and still I am receiving the same error, even though my sql query is correct, here's the screenshot

 

[Ken2k7]

Well that error is why you're not redirecting. Apparently your login information is incorrect as stated in the error message.

[sasori]

Well that error is why you're not redirecting. Apparently your login information is incorrect as stated in the error message.

 

its impossible...because sir, Im 100% sure, I tried logging in the exact email address and password from my users table (infact i only use 1 password for all dummy email accounts and the all got same password hash,.. any other solutions you might have in mind?

[Ken2k7]

1. Please don't call me sir. I'm only 19. It feels weird. Thanks!

2. Right before $sql, can you echo $p to see if it's correct? You don't have to post it here. Just verify it's correct.

3. Then echo $sql to make sure that's correct.

[sasori]

hmmmn...it doesn't return anything when I tried to log-in after i included echoing $e or $p in the script..it just squirts out the sql query itself because of the echo rigth before sql query

[Ken2k7]

So $p returns nothing or was that $e?

[sasori]

So $p returns nothing or was that $e?

 

both doesn't return anything,.. (even if i corrected my mistake on the function escape_data($data) ,,before it was escape_data($dbc) ..but i think it doesn't have something to do with the problem)

[Ken2k7]

Well it may.

 

function escape_data($data){
  global $dbc;
  // if this if condition is true, then you stripslashes($data)
  // but you will return *NOTHING*. So if this condition is true,
  // then calling this function will give you nothing back.
  if(ini_get('magic_quotes_gpc')){
    $data = stripslashes($data);
  }else{
    return mysql_real_escape_string(trim($data),$dbc);
  }
}

 

Read comments above.

[sasori]

Read comments above.

 

omg..its now redirecting..thanks for the help bro...and thanks for emphasizing the "return $data"...next time ill keep my eye on that returning stuffs