login using session in php

Question

<?php
ob_start();
include("db_connect.php");
$tbl_name='login';
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
 $myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$encrypted_mypassword = crypt($mypassword,'ctk'); 

 $sql="SELECT * FROM $tbl_name WHERE u_name='$myusername' and password='$encrypted_mypassword'";
$result=mysql_query($sql);
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
if($count==1){
session_register("myusername");
session_register("encrypted_mypassword");
header("location:edit-grid.php");
}
else {header("location:main_login.php?a=Login Failed Try Again!!");
//echo "Wrong Username or Password";
}
ob_end_flush();
?>

i have a login page shown above, in localhost it works fine,but shows an error in firebug: Failed to load source for: http://localhost/emp_tracker/main/checklogin.php

In server that is when it is hosted it does not re-direct it fails(session fails),

Answer 1

Even i had the same issue, but could not figure out the actual reason. Some points which might help are, 1) There should be no output before header. ie. no echo or html 2) Also check if there is proper semicolon at end of each php statement wherever required. 3) After searching on google, it seems the issue might only show up in older version of firebug. (Not sure) 4) Try running each line of code at a time. i.e see if username and passowrd are posted properly by echoing. Also database connection is proper and the query results are as expected.

Do you get a 500 internal server error on server?

Answer 2

Updated answer

This code should work:

session_start();
include("db_connect.php");

$myusername = mysql_real_escape_string($_POST['myusername']);
$mypassword = crypt($_POST['mypassword'], 'ctk'); 
$mypassword = mysql_real_escape_string($mypassword);

$sql = "SELECT * FROM `login` WHERE `u_name` = '$myusername' and `password` = '$encrypted_mypassword'";
$result = mysql_query($sql);

if(mysql_num_rows($result) == 1)
{
    $_SESSION['myusername'] = $myusername;
    $_SESSION['encrypted_mypassword'] = $encrypted_mypassword;
    header("Location: http://servername/folder/edit-grid.php");
}
else
{
    header("Location: http://servername/folder/main_login.php?a=Login Failed Try Again!!");
}

Original answer

The line below doesn't make sense. You already started the session at the beginning of your script. Also session_start doesn't take any arguments. Removing it may solve your problem.

session_start('myusername');

Also, you should use the full URL when redirecting:

HTTP/1.1 requires an absolute URI as argument to » Location: including the scheme, hostname and absolute path, but some clients accept relative URIs. You can usually use $_SERVER['HTTP_HOST'], $_SERVER['PHP_SELF'] and dirname() to make an absolute URI from a relative one yourself.

Source: http://www.php.net/manual/en/function.header.php

Edit: There is another mistake in your script. It's in this line:

$_SESSION['myusername']=$result['myusername'];

You use $result['myusername'];, but you should fetch the results first. Like this:

$row = mysql_fetch_assoc($result);
$_SESSION['myusername'] = $row['u_name'];