PHP-Authentication code error (isset($_POST['username'])) always returns false,

Question

I am making this simple code for authentication of a user. the page with the form is : >login.php. with the following code.

login.php :

<html>    
<body>  

<div style="position:absolute;left:300px;top:300px;width:300px;height:100px;z-index:9;>  

<form name="form1" method="POST" action="check.php">  
Username:<br />  
  <input type="text" name="Username" />  
  <br /><br />   
  Password:<br />  
  <input type="password" name="Password" />  
  <br /><br /><br/>  
  <input type=button onClick="location.href='check.php'" value='Continue'       name='continue'/>  
  </form>  
</div>  
</body>  
</html>

the form field values are being used in the next php page with following code:

check.php :

<?php
session_start();
$con = mysql_connect("localhost", "root", "");
mysql_select_db("aviation", $con) or die(mysql_error());
if (isset($_POST['continue'])) {
    $userName = $_POST[Username];
    $passWord = $_POST[Password];
    mysql_select_db('aviation');
    $query = "select * from users where Username='" . $userName . "'and     Password='" . $passWord . "'";
    $result = mysql_query($query, $con);
    if (!$result) {
        die('Could not enter data: ' . mysql_error());
    }
    $rows = mysql_num_rows($result);
    if ($rows == 1) {
        $_SESSION['Username'];
        $_SESSION['Password'];
        echo "Successful";
        echo "<BR>";
        echo "You are authorized to update the status of Bays.";
        echo "<BR>";
        $Msg = "Redirecting....";
        echo '<script type="text/javascript">  
         alert("' . $Msg . '");  
  </script>';
        header("location:upbstatus.php");
    } elseif ($userName == "" || $passWord == "") {
        $errorMsg = "Data was not entered <br/> Enter Username and Password";
        echo '<script type="text/javascript">  
         alert("' . $errorMsg . '");  
  </script>';
        else {
            $errorMsg = "Data Does Not Match <br/> Re-Enter Username and Password";
            $errorMsg = "Data was not entered <br/> Enter Username and Password";
            echo '<script type="text/javascript">  
         alert("' . $errorMsg . '");  
  </script>';
        }
    } else {
        echo ("  =============== not SET ===============");
    }
?>

It always return : =============== not SET ===============

I am so stuck at why is this happening.Can anybody help please? It'l be appreciated.
Thankyou.

Don't store your passwords in plain text.

Ja͢ck
– Ja͢ck

2012-12-29 17:36:23 +00:00
Commented Dec 29, 2012 at 17:36 — Ja͢ck
– Ja͢ck, Commented Dec 29, 2012 at 17:36
Ma'am, where is the submit button?

Salman Arshad
– Salman Arshad

2012-12-29 19:41:53 +00:00
Commented Dec 29, 2012 at 19:41 — Salman Arshad
– Salman Arshad, Commented Dec 29, 2012 at 19:41

Shiplu Mokaddim · Accepted Answer · 2012-12-30 18:52:55Z

2

Your onclick (onClick="location.href='check.php'") event handler is requesting check.php before the form can make a POST request. Once the button is clicked it redirects to check.php which sends a GET request to check.php NOT POST.

To fix it you need to change the button to a submit typed input.

   <input type='submit' value='Continue' name='continue' />

Additional information:

Quote array indices. Like $_POST['Username']
Escape parameters in sql using mysql_real_escape_string. or Use prepared statements.

edited Dec 30, 2012 at 18:52

answered Dec 29, 2012 at 17:39

Shiplu Mokaddim

57.5k20 gold badges147 silver badges193 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

frustratedtech Over a year ago

Voted down for not using proper double quotes in your answer.

Shiplu Mokaddim Over a year ago

@frustratedtech you can omit quotation in certain cases. This is one of those cases.

Community · Accepted Answer · 2017-05-23 11:43:06Z

There are a few issues with the code:

Weird form behaviour

<input type=button onClick="location.href='check.php'" value='Continue'       name='continue'/>

Why are you doing this? This wouldn't send the username and password fields at all, because the browser will redirect before the form is submitted. If you want to submit the form when clicked, use <input type="submit">

<input type="submit" value="Continue" name="continue" />

Quote array indices

$userName = $_POST[Username];  
$passWord = $_POST[Password];

This causes notices to be raised in PHP because the constant Username doesn't exist. Use this instead:

$userName = $_POST['Username'];
$passWord = $_POST['Password'];

I won't get into the scenario where $_POST['Username'] might not be set.

Escape variables in SQL

$query = "select * from users where Username='".$userName."'and     Password='".$passWord."'";

This is dangerous; you should escape the variables properly:

$query = sprintf("select * from users where Username='%s' and Password='%s'",
    mysql_real_escape_string($userName),
    mysql_real_escape_string($passWord)
);

Don't store passwords in plain text

Storing passwords in plain text is just asking for trouble. Use bcrypt to store a hash of the password instead.

See also: Secure hash and salt for PHP passwords

Don't use mysql_xx functions

This feature is deprecated in favour of PDO / mysqli and prepared statements.

frustratedtech · Accepted Answer · 2012-12-29 17:40:23Z

0

Remove on click in your submit button. While your at your it, fix your quotes.

answered Dec 29, 2012 at 17:40

frustratedtech

4334 silver badges9 bronze badges

Comments

Xfile · Accepted Answer · 2012-12-29 17:45:58Z

0

<form name="form1" method="POST" action="check.php">  
Username:<br />  
  <input type="text" name="Username" />  
  <br /><br />   
  Password:<br />  
  <input type="password" name="Password" />  
  <br /><br /><br/>  
  <input type="submit" value="Continue" name="continue"/>  
  </form>

answered Dec 29, 2012 at 17:45

Xfile

6848 silver badges19 bronze badges

Collectives™ on Stack Overflow

PHP-Authentication code error (isset($_POST['username'])) always returns false,

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related