Question

I’m trying to make a login page for my website

I am using xampp at the moment to test before I upload it to my host and made a mysql database with some test data in.

When I go to local localhost/xampp/Login.php I get the errors:
Notice: Undefined index: username in C:\xampp\htdocs\xampp\Login.php on line 41

Notice: Undefined index: password in C:\xampp\htdocs\xampp\Login.php on line 41

Notice: Undefined index: logout in C:\xampp\htdocs\xampp\Login.php on line 43

Notice: Undefined index: test_account in C:\xampp\htdocs\xampp\Login.php on line 25

The first line here is line 41

if($_POST['username'] !='' || $_POST['password'] != '') {
$login_status = login($_POST['username'], $_POST['password']);
} else if($_GET['logout']) {
logout();
}
$userid = status();

My form sends the data so I don’t understand why it gives errors

<form action="Login.php" method="POST">
<input type=text name=username>
<input type=password name=password>
<input type=submit value="Log In">
</form>

when I click the login nothing happens, this is the full php file I am using

<?php

    $link = mysql_connect("localhost", "admin", "1234");
    mysql_select_db("test_database", $link);

function login($username, $password) {
        $username = addslashes($username);
        $password = md5($password);
    $query = mysql_query("SELECT * FROM user_accounts WHERE username='$username' AND password='$password'");
    if(mysql_num_rows($query) == 1) {
        $info = mysql_fetch_array($query);
        $userid = $info[userid];
        $sessionid = md5($userid . time());
        $time = time();
        @setcookie ('test_account', $sessionid, $time+3600, '/', '');
        mysql_query("DELETE FROM user_sessions WHERE userid='$userid'");
        mysql_query("INSERT INTO user_sessions (sessionid,userid,timestamp) VALUES('$sessionid','$userid','$time')");
        return $userid;
    } else {
        return 0;
    }
}

function status() {
    $sessionid = $_COOKIE[test_account];
    $oldtime = time() - 3600;
    $query = mysql_query("SELECT * FROM user_sessions WHERE sessionid='$sessionid' AND timestamp>$oldtime");
    if(mysql_num_rows($query) == 1) {
        $info = mysql_fetch_array($query);
        return $info[userid];
    }
    return 0;
} 

function logout() {
    $sessionid = $_COOKIE[test_account];
    @setcookie ("test_account",'', time()-99999, '/', '');
    mysql_query("DELETE FROM user_sessions WHERE sessionid='$sessionid'");
}

if($_POST[username] !='' || $_POST[password] != '') {
    $login_status = login($_POST[username], $_POST[password]); 
} else if($_GET[logout]) {
    logout();
}
$userid = status();


if($userid > 0) { echo "Welcome to our site, user #$userid (<a href='?logout'>Click here to logout</a>)"; } else {

if($login_status != '' $login_status == 0) { echo "Invalid username/password combo.<br>"; }
?>

<form action="sample.php" method="POST">
<input type=text name=username>
<input type=password name=password>
<input type=submit value="Log In">
</form>

<?php } ?>

Answer 1

You need to check whether the $_POST is set in the first place like this:

<?php
    if(isset($_POST['username'])&& isset($_POST['password']))
    {
        if(!empty($_POST['username']) && !empty($_POST['password'])) {
            $login_status = login($_POST['username'], $_POST['password']); 
        } else if($_GET['logout']) {
            logout();
        }
    }
?>

In your form, you should use extra ” around the names of items as follows:

<form action="sample.php" method="POST">
    <input type="text" name="username">
    <input type="password" name="password">
    <input type="submit" value="Log In">
</form>