Question

Please I need your help with this log-in script. When a user registers, a column active in the database is set to zero (0), and an activation link is sent to the email they provided. When the activation link is clicked and if successful, their respective active column is set to 1.

But a correct combination of username and password only works when i click the submit button twice.

On the first click i get the following lines

Notice: Undefined index: remember in C:\wamp\www\church\login.php on line 37

Not Verified Yet

But when I click the second time the log-in works.

<?php
if (isset($_POST['submit'])) {
    $username = trim($_POST['username']);
    $username = strip_tags($_POST['username']);
    $username = htmlentities($_POST['username']);
    $username = stripslashes($_POST['username']);
    $username = mysql_real_escape_string($_POST['username']);
    $password = sha1($_POST['password']);

    if (isset($_POST['username']) && isset($_POST['password'])) {
        $query = mysql_query("SELECT username, password
                           FROM USERS
                           WHERE username = '$username'
                           AND password = '$password'") or die (mysql_error());

        $user = mysql_num_rows($query);
        if ($user == 1) {
            $row = mysql_fetch_assoc($query);
            if ($row['active'] == 1) {
                $_SESSION['logged_username'] = $username;
                if ($_POST['remember']) {
                    setcookie("CookieUser", $_SESSION['logged_username'], time() + 60 * 60 * 24 * 100, "/");
                    setcookie("CookiePass", $password, time() + 60 * 60 * 24 * 100, "/");

                    header('Location: http://127.0.0.1/church/index.php?id=1');
                }
            }
            if ($row['active'] !== 1) {
                echo "Not Verified Yet";
            }
        }
        else {
            echo "<div id='content' >";
            echo "<div class='OpenError' >";
            echo "Username & Password Combination Is Wrong";
            echo "</div>";
            echo "</div>";

        }
    }
}
?>

Answer 1

The issue isn’t that you aren’t being logged in. It’s that your code does not die() after sending the redirect header and therefore continues executing the code on that page. Also, if the user does not select remember, nothing happens. To fix (the first issue), simply add die(); immediately after header("location: ...");.

Why do I need die(); after header("location: ...");?

The header() function sends a string (text) to the browser (or other program requesting the page). However, the server doesn’t know the difference between header("location: ..."); and header("somerandomthing: ...");, so it continues executing code until it either reaches the end of the script, an error, or the client disconnects. So, to prevent code execution from continuing, simply add die(); after every header("location: ..."); call.

Update regarding not checking ‘remember’

<?php
if ($user == 1) {
        $row = mysql_fetch_assoc($query);
        if ($row['active'] == 1) {
            $_SESSION['logged_username'] = $username;
            if ($_POST['remember']) {
                setcookie("CookieUser", $_SESSION['logged_username'], time() + 60 * 60 * 24 * 100, "/");
                setcookie("CookiePass", $password, time() + 60 * 60 * 24 * 100, "/");

            }
            // Redirect even if not 'remembered'
            header('Location: http://127.0.0.1/church/index.php?id=1');
            die;
        }
        if ($row['active'] !== 1) {
            echo "Not Verified Yet";
        }
    }