php login works offline but not online

Question

Good day everyone, I am new with PHP. I checked w3c and got some good tips. However I have a small challenge with my login code. It shows PHP Warning: Cannot modify header information - headers already sent by (output started at /home/perspect/public_html/jst/dbcon.php:2) in /home/perspect/public_html/jst/index.php on line 8 Below is my index page;

<?php
session_start();
include_once 'includes/dbcon.php';

if(isset($_SESSION['user'])!="")
{
    header("Location: candidate_list.php");
}

if(isset($_POST['btn-login']))
{

    $username = mysqli_real_escape_string($con, $_POST['username']);
    $password = mysqli_real_escape_string($con, $_POST['password']);
    $stat = 'notvoted';

    $res=mysqli_query($con,"SELECT * FROM students WHERE username='$username' AND status='$stat'");
    $row=mysqli_fetch_array($res);

    if($row['password']==md5($password))
    {
        $_SESSION['user'] = $row['user_id'];
        header("Location: candidate_list.php");
    } 
    else
    {
        ?>
        <script>alert('wrong details');</script>
        <?php
    } 

}
?>
<!-- Login Box -->
                            <div class="col-md-6 col-md-offset-3 col-sm-offset-3">
                                <form class="login-page" action="" method="post">
                                    <div class="login-header margin-bottom-30">
                                        <h2>Login</h2>
                                    </div>
                                    <div class="input-group margin-bottom-20">
                                        <span class="input-group-addon">
                                            <i class="fa fa-user"></i>
                                        </span>
                                        <input placeholder="VIN" name="username" class="form-control" type="text">
                                    </div>
                                    <div class="input-group margin-bottom-20">
                                        <span class="input-group-addon">
                                            <i class="fa fa-lock"></i>
                                        </span>
                                        <input placeholder="Password" name="password" class="form-control" type="password">
                                    </div>
                                    <div class="row">

                                        <div class="col-md-6">
                                            <button class="btn btn-primary pull-right" type="submit" name="btn-login">Login</button>
                                        </div>
                                    </div>
                                    <p> 
                                </form>
                            </div>
                            <!-- End Login Box -->

my candidate_list.php code is;

<?php
session_start();
include_once 'includes/dbcon.php';

if(!isset($_SESSION['user']))
{
    header("Location: index.php");
}
$res=mysqli_query($con, "SELECT * FROM students WHERE user_id=".$_SESSION['user']);
$userRow=mysqli_fetch_array($res);
?>

My dbcon is

  <?php

$con=mysqli_connect("xxx","xxx","xxxx","xxx");
// Check connection
if (mysqli_connect_errno()) {
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}

?>

Thank you for your help.

Did you try to change this line : `isset($_SESSION['user'])!=""` by `isset($_SESSION['user'])` ? — Guillaume Sainthillier, Jun 03 '17 at 09:40
thank you everyone for your suggestions and contributions..@Hitanshu Malhotra answer helped solve the issue — Felicity Okache, Jun 03 '17 at 10:58
MD5 is not sufficient for password hashing. Use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php) instead. — Alex Howansky, Jun 04 '17 at 22:48

score 1 · Accepted Answer · answered Jun 03 '17 at 10:11

1

This type of php warning will come once you echo something before header redirect.

If you still want to redirect you can use ob_start or you can use javascript

window.location.href=path

answered Jun 03 '17 at 10:11

Hitanshu Malhotra

102
2

this idea really helped me get it right.. thanks a lot – Felicity Okache Jun 03 '17 at 10:57

php login works offline but not online

1 Answers1