Html LogIn form not functioning

Question

Ok, I have a login form that looks like this:

<form id="loginForm" name="loginForm" method="post" action="login-exec.php">
<table width="300" border="0" align="center" cellpadding="2" cellspacing="0">
<tr>
  <td width="112"><b>Login</b></td>
  <td width="188"><input name="login" type="text" class="textfield" id="login" /></td>
</tr>
<tr>
  <td><b>Password</b></td>
  <td><input name="password" type="password" class="textfield" id="password" /></td>
</tr>
<tr>
  <td>&nbsp;</td>
  <td><input type="submit" name="Submit" value="Login" /></td>
</tr>
</table>
</form>

Now, This form is on a page in a directory called members. When i put it on a page in the home directory and change the action to "members/login-exec.php" When I try to logIn it just refreshes the page, but the name of the page in the browser changes to the actions taking place in the form.

Any ideas on making this work guys?

EDIT, heres the login-exec.php code:

<?php
//Start session
session_start();

//Include database connection details
require_once('config.php');

//Array to store validation errors
$errmsg_arr = array();

//Validation error flag
$errflag = false;

//Connect to mysql server
$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
if(!$link) {
 die('Failed to connect to server: ' . mysql_error());
}

//Select database
$db = mysql_select_db(DB_DATABASE);
if(!$db) {
 die("Unable to select database");
}

//Function to sanitize values received from the form. Prevents SQL injection
function clean($str) {
 $str = @trim($str);
 if(get_magic_quotes_gpc()) {
  $str = stripslashes($str);
 }
 return mysql_real_escape_string($str);
}

//Sanitize the POST values
$login = clean($_POST['login']);
$password = clean($_POST['password']);

//Input Validations
if($login == '') {
 $errmsg_arr[] = 'Login ID missing';
 $errflag = true;
}
if($password == '') {
 $errmsg_arr[] = 'Password missing';
 $errflag = true;
}

//If there are input validations, redirect back to the login form
if($errflag) {
 $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
 session_write_close();
 header("location: login-form.php");
 exit();
}

//Create query
$qry="SELECT * FROM members WHERE login='$login' AND passwd='".md5($_POST['password'])."'";
$result=mysql_query($qry);

//Check whether the query was successful or not
if($result) {
 if(mysql_num_rows($result) == 1) {
  //Login Successful
  session_regenerate_id();
  $member = mysql_fetch_assoc($result);
  $_SESSION['SESS_MEMBER_ID'] = $member['member_id'];
  $_SESSION['SESS_FIRST_NAME'] = $member['firstname'];
  $_SESSION['SESS_LAST_NAME'] = $member['lastname'];
  session_write_close();
  header("location: members.php");
  exit();
         }else {
  //Login failed
  header("location: login-failed.php");
  exit();
         }
                }else {
         die("Query failed");
                }
                    ?>

Answer 1

It sounds to me like you have some code in login-exec.php which isn't working right. See if you can trace through that page to see 1. if it's being called; 2. at what point is it bailing.

My guess is that the redirect in login-exec.php believes it is running in the wrong directory.

Answer 2

Are you trying to perform a header redirect in the login-exec.php file? If so, are you using a relative or absolute path? Problem might be there as it should be an absolute path.

Answer 3

Sounds like you're hitting the first redirect. In order to debug, can you try putting a die() statement just before header("location: login-form.php");?

Example:

die('Found error. Session: ' . var_export($_SESSION, true));
header("location: login-form.php");

The response about absolute paths is on the right track - but as long as you supply a valid login, you should be fine. I'm assuming that members.php is stored under the members directory?

It is a good practice to always use absolute paths in redirects, regardless of whether they are needed.

Update: After checking your site, it looks like the issue is an unclosed <form> tag before the login form. If you close that tag, or move the login form out of that other form, you should be fine. The first form tag doesn't specify action or method so is just doing a GET request to the same page, putting your data in the URL.

Answer 4

You are using header redirects in login-exec.php using relative urls, you should use the absolute path.

Answer 5

If none of the above have worked, the only other thing that I can think of is that it might the path in your "action". Have you tried ./members/login-exec.php (as opposed to members/login-exec.php)?

Answer 6

First, here's your form but without the tables. This should be a bit easier to debug and it is more semantic:

 <form id="loginForm" name="loginForm" method="post" action="members/login-exec.php">
  <fieldset id="login_fields">
     <label for="login">Login</label>
          <input name="login" type="text" class="textfield" id="login" />
     <label for="password">Password</label>
          <input name="password" type="password" class="textfield" id="password" />
     <input type="submit" name="Submit" value="Login" />
  </fieldset>
</form>

So the tricky part is figuring out if the error is happening with the form or the script. I would always assume the script, but it's refreshing, which is strange.

Have the script do something silly instead of checking the post variables. Like have the script output the user name entered, or just "I am your script. Clicking submit got you here."

If the script outputs whatever you use, that means the form is fine (I think).

Did you update the script for the header("Location: members.php") part to redirect to the relative location of the members.php script?

To avoid relative location issues, you could always use the full path, so make the action:

 action="/members/login-exec.php"

and this will work no matter where you put it.

And do the same for the login verification script:

 header("Location: /members/members.php")

Or you could even use the full path if you are comfortable with that.

---

Couple of other things:

One: You could also use the full URL for the action/location. I would consider doing this at least for the Location header. Since the form seems to go somewhere and do something, the action part is probably fine. But the location header is probably a bit more testy.

Second: I'm wondering if the reason why the script is doing something weird is because PHP is trying to guess where the files are. PHP by default will seek out an included file if it's not where it's supposed to be (which makes PHP extremely exploitable, unfortunately). Maybe it does the same thing for Location headers? I really doubt it, but it could be related at another point I'm not noticing.

Answer 7

See: http://www.webloginproject.com/login-project/php/

If you don't use the free code, at least you can see how a robust and secure system was written.