Question

I have a simple PHP login script that directs the user to dashboard.php if the login is successful. Currently, all it is doing is refreshing the page.

    <?php 
if (isset($_POST["submit"])) {
    // startar sesion
    session_start(); 

// username and password
$userName = "user";
$password = "pass";
}

if (isset($_POST["userName"]) && isset($_POST["password"])) { 

    if ($_POST["userName"] == $userName && $_POST["password"] == $password) { 

    header( 'Location: dashboard.php' ) ; 
    } 
        // wrong login - message
        else {echo 'foo';} 
    }
    ?>

Answer 1

Try this

<?php 

session_start(); 

 // username and password
 $_SESSION['user'] = "user";
 $_SESSION['pass']= "pass";


if (isset($_POST["userName"]) && isset($_POST["password"])) { 

if ($_POST["userName"] == $_SESSION['user'] && $_POST["password"] ==    $_SESSION['pass']) { 

header( 'Location: dashboard.php' ) ; 
} 
    // wrong login - message
    else {echo 'foo';} 
}
?>

That just fixes your original code, however i would lean to more like this…

 <?
  session_start(); //always at the top of each page

  If empty($_SESSION){ header('location':'login.php')}

  else {header('location':'dashboard.php');

Then you rewrite login to always assign session user and pass if the credentials have been verified authenticated

Check post, if post exists compare to vals, if user password match, write them respective to their session array nodes, the redirect to dashboard which should also have thatfunctionality i outlined above at the top of its page to check session

Also do not store the users password in the session, just the verified user name should suffice and keep your site clean from potential intruders hacking in and stealing passwords of others