Question

I have been trying to make a user login page that, when the user logs in, will redirect a user based on the user id to a specific url.

To be more specific, let’s say in the database I have 4 rows: id, username, password, redirect. After successful login it will go to a user’s specific row, grab the redirect url, and redirect the user to that url. I have made a script that will redirect the url based on the database’s redirect url, but when I add more users to the db it freezes and often does not display anything or redirects to the wrong url. Here is the code:

<?php 
$host="localhost"; // Host name 
$username="root"; // Mysql username 
$password=""; // Mysql password 
$db_name="test"; // Database name 
$tbl_name="members"; // Table name 

// Connect to server and select databse. 
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB"); 

// username and password sent from form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection) 
$myusername = stripslashes($myusername); 
$mypassword = stripslashes($mypassword); 
$myusername = mysql_real_escape_string($myusername); 
$mypassword = mysql_real_escape_string($mypassword); 
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'"; 
$result=mysql_query($sql); 

// Mysql_num_row is counting table row 
$count=mysql_num_rows($result); 
// If result matched $myusername and $mypassword, table row must be 1 row 
if($count==1){ 
// Register $myusername, $mypassword and redirect to file"login_success.php" 
$_SESSION['username'] = $myusername; 
$_SESSION['password'] = $mypassword; 
$result = mysql_query("SELECT redirect FROM members"); 

while ($row = mysql_fetch_array($result, MYSQL_ASSOC)) { 
   header("Location: " . $row['redirect']); 
} 
exit(); 
} 
else { 
echo "Wrong Username or Password"; 
} 
?> 

I really appreciate any help, tutorials, or criticism. Thank you.
(Please also be descriptive in your answers I am still pretty new to web development. 😉 )

Answer 1

Since you can only redirect a person one time, and you already have the redirect value from your original select query that checked for a username and password match, I would change your code to something like this:

$sql = "SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'"; 
$result = mysql_query($sql); 

// Mysql_num_row is counting table row 
$count = mysql_num_rows($result); 

// If result matched $myusername and $mypassword, table row must be 1 row 
if($count == 1){ 
    // Register $myusername, $mypassword and redirect to file"login_success.php" 
    $_SESSION['username'] = $myusername; 
    $_SESSION['password'] = $mypassword; 

    $result = mysql_fetch_array($result); // get the result set from the query

    $redirect = trim($result['redirect']); // get the redirect column's value

    if ($redirect == '') {
        echo "No redirect value was set!";
    } else {
        header('Location: ' . $redirect);
        exit;
    }
} else { 
    echo "Wrong Username or Password"; 
}