Question

Okay so basically, i have been trying this for and hour or 2 now.
When a user log’s in on my webpage, they dont seem to be redirected to the user.php.
They only see a small empty box and are still on index.php.

My form action is this:

 <form id="login" method="POST" autocomplete="off" action="<?php echo $_SERVER['PHP_SELF'];?>">

And then there is the code to be executed when the user successfully log’s in:

if ($username == $dbusername && md5($password) == $dbpassword)
{                  
  //You're in!
  $_SESSION['username'] = $username;

  header("Location:user.php");      
}
else die blablabla

And still the users dont seem to be redirected.

What would i do?

Answer 1

First of all, $_SERVER["PHP_SELF"] is sensitive to XSS, so please escape it.

Put a die() statement after your header statement (which should use only absolute URIs, not relative ones like you did).