I would like to suggest you few solutions.
Solution 1
GET Param (Indeed you says don't want to)
I don't see any issue with sending GET Param, since it doesn't contain any sensitive data. As an example you can use some internal CODEs for this.
Ex:
You define some codes.
$code = 1; // This should be dynamic like,
// 1 => When Password wrong,
// 2 => When login ID not exists,
// 3 => when unknown error occurred
header('Location: error.php?err=' . $code);
So in error.php you can check that.
$errorCode = $_GET['err'];
switch($errorCode)
{
case 1;
{
echo "Password wrong";
break;
}
case 2;
{
echo "login ID not exists";
break;
}
// Add custom messages as you wish
}
Solution 2
Using session. I think it doesn't matter if you have multiple tabs. In your password checking code you can initiate the session before the redirection.
$_SESSION['ERROR_MESSAGE'] = "Whatever you want";
Then in your error.php (the redirected page) you can check that
if(isset($_SESSION['ERROR_MESSAGE']))
{
echo $_SESSION['ERROR_MESSAGE'];
unset($_SESSION['ERROR_MESSAGE']);
}
Solution 3
Instead of PHP redirect, you can generate hidden form with POST action and you can assign relevant error message to that when executing
<form name="frmError" id="frmError" method="POST" action="error.php">
<input type="hidden" name="error" value="<?php echo $errorMessage; ?>" />
</form>
And write a javascript function to POST your form.
<script type="text/javascript">
function submitform()
{
document.frmError.submit();
}
</script>
Then modify your body tag as bellow
<body <?php if(isset($errorMessage)) {?> onload="submitform();" <?php } ?> >
Hope this will help you to decide.