User validation across web pages

[czechg]

Hi guys, I know this is probably something silly but I have spend past 5 hours looking at it and cannot find what the deal is. I have login.html and update.html that are served by login.php, update.php, and connection.php. I can connect to the database so my connection.php is working fine, I can log in and invoke SESSION() for the user, but when I want to utilize the update.php to actually retrieve/update the data in my database I am just getting blank page. 

 

My login.php is here:

<?php

if(isset($_POST['username']) and isset($_POST['password']) ) {
		include('connection.php'); //code used for database connection
		$user=$_POST['username'];
		$pass=$_POST['password'];
 
		$ret=mysqli_query( $con, "SELECT * FROM users WHERE username = '$user' AND password = '$pass' ") or die("Could not execute query: " .mysqli_error($con));
		$row = mysqli_fetch_assoc($ret);
		if(!$row) {
			header("Location: ../error.html");
		}
		else {
	        session_start();
	        $_SESSION["user"]= "OK";
			header("Location: ../update.html");
		}
}

?>

My update.php: 

<?php

session_start() ;
if(!isset($_SESSION["user"]) && $_SESSION["user"] == "OK")) {
header("Location: ../login.html") ;
exit ;
}

if(!isset($_POST['Retrieve'])) {

include 'connection.php' ;
include 'login.php' ;

		$name=$_POST['name'];
		$company=$_POST['company'];
		$datefrom=$_POST['datefrom'];
		$dateto=$_POST['dateto'];
	
 
		$list=mysqli_query( $con, "SELECT * FROM Leads WHERE name='$name' OR company='$company' OR date >='$datefrom' AND date<='$dateto' ") or die("You have to input name, company or dates: " .mysqli_error($con));
		
		echo "<table border='1'>
		<tr>
		<th>Name</th>
		<th>Company</th>
		<th>Email</th>
		<th>Phone</th>
		<th>Message</th>
		<th>Date</th>
		</tr>";

		while($row = mysqli_fetch_array($list))
		{
		echo "<tr>";
		echo "<td>" . $row['Name'] . "</td>";
		echo "<td>" . $row['Company'] . "</td>";
		echo "<td>" . $row['Email'] . "</td>";
		echo "<td>" . $row['Phone'] . "</td>";
		echo "<td>" . $row['Message'] . "</td>";
		echo "<td>" . $row['Date'] . "</td>";
		echo "</tr>";
		}
		echo "</table>";

mysqli_close($con);
}
		
if(!isset($_POST['Update'])) {

include 'connection.php' ;

		$name=$_POST['name'];
		$company=$_POST['company'];
		$notes=$_POST['notes'];
		$contactdate=$_POST['contactdate'];
	
 
		$list=mysqli_query( $con, "UPDATE Leads SET notes='$notes', date='$contactdate' WHERE name='$name' ") or die("Update did not happen: " .mysqli_error($con));
		
		header("Location: ../success.html");

mysqli_close($con);
}

?>

Any help will be greatly appreciated.

[benanamen]

You have many problems with this code. Rather than get into everything that is wrong, which is pretty much all of it, I suggest you study the following PDO tutorial and write your code accordingly.

 

https://phpdelusions.net/pdo

[ginerjm]

One thing you could do is to add some echo statements in the problem script to see what is happening.  Also - be sure you have php error checking turned on in all php scripts.  (see my signature)

[taquitosensei]

Just to clarify. The white page is syntax errors in your php and error checking is not turned on.

Put this at the top of the page to show the errors. 

error_reporting(E_ALL);
ini_set('display_errors', 1);

[czechg]

I got it!

 

Thanks guys.

[ginerjm]

When a problem is solved it is nice to hear what you had to do to make it so in case someone else reads this thread in the future.

 

Was it simply a matter of turning on php error checking as your were advised in order to see your programming errors, or was it something else?