Restrict user from accessing webpage + Incorrect username/password alert












0















I'm using php but without database.



When I log in with the wrong username/password, it shows "Incorrect username/password" which is correct.



However, when I access the other webpages without logging in, it also shows "Incorrect username/password" instead of "You must be logged in to access this page".



<?php
$username = "admin";
$password = "its30305";

session_start();

if(isset($_SESSION['username])){
echo "<h1>Welcome ".$_SESSION['username]."</h1>";
}

else{
if($_POST['username] == $username && $_POST['password'] == $password){
$_SESSION['username] = $username;
echo "<script>location.href='mainmenu.php'</script>;
}

elif($_POST['username] != $username || $_POST['password'] != $password){
echo "<script>alert('Username/Password incorrect!')</script>";
echo "<script>location.href='login.php'</script>;
}

elif(!isset($_SESSION['access]){
echo "<script>alert('You must log in to access this page')</script>";
echo "<script>location.href='login.php'</script>;
}


?>










share|improve this question

























  • You need to post your code here, as code and not as an image.

    – jeroen
    Nov 23 '18 at 15:37






  • 1





    Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

    – Sfili_81
    Nov 23 '18 at 15:38






  • 1





    The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

    – Hristijan Gjorshevski
    Nov 23 '18 at 15:40











  • @jeroen sorry, it's my first time using this. just added my code.

    – Hello
    Nov 23 '18 at 15:51











  • In your code remember that you have to put session_start in the first line...

    – Ferdinando
    Nov 23 '18 at 22:43
















0















I'm using php but without database.



When I log in with the wrong username/password, it shows "Incorrect username/password" which is correct.



However, when I access the other webpages without logging in, it also shows "Incorrect username/password" instead of "You must be logged in to access this page".



<?php
$username = "admin";
$password = "its30305";

session_start();

if(isset($_SESSION['username])){
echo "<h1>Welcome ".$_SESSION['username]."</h1>";
}

else{
if($_POST['username] == $username && $_POST['password'] == $password){
$_SESSION['username] = $username;
echo "<script>location.href='mainmenu.php'</script>;
}

elif($_POST['username] != $username || $_POST['password'] != $password){
echo "<script>alert('Username/Password incorrect!')</script>";
echo "<script>location.href='login.php'</script>;
}

elif(!isset($_SESSION['access]){
echo "<script>alert('You must log in to access this page')</script>";
echo "<script>location.href='login.php'</script>;
}


?>










share|improve this question

























  • You need to post your code here, as code and not as an image.

    – jeroen
    Nov 23 '18 at 15:37






  • 1





    Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

    – Sfili_81
    Nov 23 '18 at 15:38






  • 1





    The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

    – Hristijan Gjorshevski
    Nov 23 '18 at 15:40











  • @jeroen sorry, it's my first time using this. just added my code.

    – Hello
    Nov 23 '18 at 15:51











  • In your code remember that you have to put session_start in the first line...

    – Ferdinando
    Nov 23 '18 at 22:43














0












0








0


0






I'm using php but without database.



When I log in with the wrong username/password, it shows "Incorrect username/password" which is correct.



However, when I access the other webpages without logging in, it also shows "Incorrect username/password" instead of "You must be logged in to access this page".



<?php
$username = "admin";
$password = "its30305";

session_start();

if(isset($_SESSION['username])){
echo "<h1>Welcome ".$_SESSION['username]."</h1>";
}

else{
if($_POST['username] == $username && $_POST['password'] == $password){
$_SESSION['username] = $username;
echo "<script>location.href='mainmenu.php'</script>;
}

elif($_POST['username] != $username || $_POST['password'] != $password){
echo "<script>alert('Username/Password incorrect!')</script>";
echo "<script>location.href='login.php'</script>;
}

elif(!isset($_SESSION['access]){
echo "<script>alert('You must log in to access this page')</script>";
echo "<script>location.href='login.php'</script>;
}


?>










share|improve this question
















I'm using php but without database.



When I log in with the wrong username/password, it shows "Incorrect username/password" which is correct.



However, when I access the other webpages without logging in, it also shows "Incorrect username/password" instead of "You must be logged in to access this page".



<?php
$username = "admin";
$password = "its30305";

session_start();

if(isset($_SESSION['username])){
echo "<h1>Welcome ".$_SESSION['username]."</h1>";
}

else{
if($_POST['username] == $username && $_POST['password'] == $password){
$_SESSION['username] = $username;
echo "<script>location.href='mainmenu.php'</script>;
}

elif($_POST['username] != $username || $_POST['password'] != $password){
echo "<script>alert('Username/Password incorrect!')</script>";
echo "<script>location.href='login.php'</script>;
}

elif(!isset($_SESSION['access]){
echo "<script>alert('You must log in to access this page')</script>";
echo "<script>location.href='login.php'</script>;
}


?>







php






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 23 '18 at 16:03







Hello

















asked Nov 23 '18 at 15:35









Hello Hello

82




82













  • You need to post your code here, as code and not as an image.

    – jeroen
    Nov 23 '18 at 15:37






  • 1





    Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

    – Sfili_81
    Nov 23 '18 at 15:38






  • 1





    The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

    – Hristijan Gjorshevski
    Nov 23 '18 at 15:40











  • @jeroen sorry, it's my first time using this. just added my code.

    – Hello
    Nov 23 '18 at 15:51











  • In your code remember that you have to put session_start in the first line...

    – Ferdinando
    Nov 23 '18 at 22:43



















  • You need to post your code here, as code and not as an image.

    – jeroen
    Nov 23 '18 at 15:37






  • 1





    Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

    – Sfili_81
    Nov 23 '18 at 15:38






  • 1





    The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

    – Hristijan Gjorshevski
    Nov 23 '18 at 15:40











  • @jeroen sorry, it's my first time using this. just added my code.

    – Hello
    Nov 23 '18 at 15:51











  • In your code remember that you have to put session_start in the first line...

    – Ferdinando
    Nov 23 '18 at 22:43

















You need to post your code here, as code and not as an image.

– jeroen
Nov 23 '18 at 15:37





You need to post your code here, as code and not as an image.

– jeroen
Nov 23 '18 at 15:37




1




1





Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

– Sfili_81
Nov 23 '18 at 15:38





Welcome to SO, i'll suggest you to read Minimal, Complete, and Verifiable example before asking

– Sfili_81
Nov 23 '18 at 15:38




1




1





The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

– Hristijan Gjorshevski
Nov 23 '18 at 15:40





The complement of $username == 'username' && $password == 'password' is $username != 'username' || $password != 'password

– Hristijan Gjorshevski
Nov 23 '18 at 15:40













@jeroen sorry, it's my first time using this. just added my code.

– Hello
Nov 23 '18 at 15:51





@jeroen sorry, it's my first time using this. just added my code.

– Hello
Nov 23 '18 at 15:51













In your code remember that you have to put session_start in the first line...

– Ferdinando
Nov 23 '18 at 22:43





In your code remember that you have to put session_start in the first line...

– Ferdinando
Nov 23 '18 at 22:43












1 Answer
1






active

oldest

votes


















1














You shouldn't validate login like that but if you want to know about the problem,
check this line:



else if(!isset($_SESSION['access']){


Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:



if(!isset($_SESSION['access']){
//Need login to access this page
}else if($_POST['username'] == $username && $_POST['password'] == $password){
//Wrong username or password
}else if ...


I strongly recommend to change structure of your code:



Use PHP forwarding instead of JavaScript forwarding



If you want to forward to the login page when user doesn't have permission to the page, use header like this:



header('location: /login.php');
die();


Always terminate the current script after forward by using die() or exit().



Check if $_POST key is set before using it



make sure $_POST set before, For example:



isset($_POST['username']) && $_POST['username'] == $username


Don't store raw password in your codes



Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:



password_hash("its30305", PASSWORD_DEFAULT);


and you can use it in your code:



$username = 'admin';
$password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm'; //Result of password_hash("its30305", PASSWORD_DEFAULT);


Read about password_hash



Use password_verify to verify your password



You can verify password with password_verify like this:



isset($_POST['password']) && password_verify($_POST['password'],$password)


Read about password_verify.



Show proper message in login page



If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:



$_SESSION['login_message'] = 1; //user need to login to see the content
header('location: /login.php');
die();


on login.php:



if (isset($_SESSION['login_message'])){
switch ($_SESSION['login_message']){
case 1:
echo 'Need to login to see the page.';
break;
case 2:
echo 'Wrong username or password.';
break;
}
//saw the message, not need it anymore!
unset($_SESSION['login_message']);
}





share|improve this answer

























    Your Answer






    StackExchange.ifUsing("editor", function () {
    StackExchange.using("externalEditor", function () {
    StackExchange.using("snippets", function () {
    StackExchange.snippets.init();
    });
    });
    }, "code-snippets");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "1"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53449415%2frestrict-user-from-accessing-webpage-incorrect-username-password-alert%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    You shouldn't validate login like that but if you want to know about the problem,
    check this line:



    else if(!isset($_SESSION['access']){


    Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:



    if(!isset($_SESSION['access']){
    //Need login to access this page
    }else if($_POST['username'] == $username && $_POST['password'] == $password){
    //Wrong username or password
    }else if ...


    I strongly recommend to change structure of your code:



    Use PHP forwarding instead of JavaScript forwarding



    If you want to forward to the login page when user doesn't have permission to the page, use header like this:



    header('location: /login.php');
    die();


    Always terminate the current script after forward by using die() or exit().



    Check if $_POST key is set before using it



    make sure $_POST set before, For example:



    isset($_POST['username']) && $_POST['username'] == $username


    Don't store raw password in your codes



    Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:



    password_hash("its30305", PASSWORD_DEFAULT);


    and you can use it in your code:



    $username = 'admin';
    $password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm'; //Result of password_hash("its30305", PASSWORD_DEFAULT);


    Read about password_hash



    Use password_verify to verify your password



    You can verify password with password_verify like this:



    isset($_POST['password']) && password_verify($_POST['password'],$password)


    Read about password_verify.



    Show proper message in login page



    If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:



    $_SESSION['login_message'] = 1; //user need to login to see the content
    header('location: /login.php');
    die();


    on login.php:



    if (isset($_SESSION['login_message'])){
    switch ($_SESSION['login_message']){
    case 1:
    echo 'Need to login to see the page.';
    break;
    case 2:
    echo 'Wrong username or password.';
    break;
    }
    //saw the message, not need it anymore!
    unset($_SESSION['login_message']);
    }





    share|improve this answer






























      1














      You shouldn't validate login like that but if you want to know about the problem,
      check this line:



      else if(!isset($_SESSION['access']){


      Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:



      if(!isset($_SESSION['access']){
      //Need login to access this page
      }else if($_POST['username'] == $username && $_POST['password'] == $password){
      //Wrong username or password
      }else if ...


      I strongly recommend to change structure of your code:



      Use PHP forwarding instead of JavaScript forwarding



      If you want to forward to the login page when user doesn't have permission to the page, use header like this:



      header('location: /login.php');
      die();


      Always terminate the current script after forward by using die() or exit().



      Check if $_POST key is set before using it



      make sure $_POST set before, For example:



      isset($_POST['username']) && $_POST['username'] == $username


      Don't store raw password in your codes



      Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:



      password_hash("its30305", PASSWORD_DEFAULT);


      and you can use it in your code:



      $username = 'admin';
      $password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm'; //Result of password_hash("its30305", PASSWORD_DEFAULT);


      Read about password_hash



      Use password_verify to verify your password



      You can verify password with password_verify like this:



      isset($_POST['password']) && password_verify($_POST['password'],$password)


      Read about password_verify.



      Show proper message in login page



      If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:



      $_SESSION['login_message'] = 1; //user need to login to see the content
      header('location: /login.php');
      die();


      on login.php:



      if (isset($_SESSION['login_message'])){
      switch ($_SESSION['login_message']){
      case 1:
      echo 'Need to login to see the page.';
      break;
      case 2:
      echo 'Wrong username or password.';
      break;
      }
      //saw the message, not need it anymore!
      unset($_SESSION['login_message']);
      }





      share|improve this answer




























        1












        1








        1







        You shouldn't validate login like that but if you want to know about the problem,
        check this line:



        else if(!isset($_SESSION['access']){


        Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:



        if(!isset($_SESSION['access']){
        //Need login to access this page
        }else if($_POST['username'] == $username && $_POST['password'] == $password){
        //Wrong username or password
        }else if ...


        I strongly recommend to change structure of your code:



        Use PHP forwarding instead of JavaScript forwarding



        If you want to forward to the login page when user doesn't have permission to the page, use header like this:



        header('location: /login.php');
        die();


        Always terminate the current script after forward by using die() or exit().



        Check if $_POST key is set before using it



        make sure $_POST set before, For example:



        isset($_POST['username']) && $_POST['username'] == $username


        Don't store raw password in your codes



        Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:



        password_hash("its30305", PASSWORD_DEFAULT);


        and you can use it in your code:



        $username = 'admin';
        $password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm'; //Result of password_hash("its30305", PASSWORD_DEFAULT);


        Read about password_hash



        Use password_verify to verify your password



        You can verify password with password_verify like this:



        isset($_POST['password']) && password_verify($_POST['password'],$password)


        Read about password_verify.



        Show proper message in login page



        If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:



        $_SESSION['login_message'] = 1; //user need to login to see the content
        header('location: /login.php');
        die();


        on login.php:



        if (isset($_SESSION['login_message'])){
        switch ($_SESSION['login_message']){
        case 1:
        echo 'Need to login to see the page.';
        break;
        case 2:
        echo 'Wrong username or password.';
        break;
        }
        //saw the message, not need it anymore!
        unset($_SESSION['login_message']);
        }





        share|improve this answer















        You shouldn't validate login like that but if you want to know about the problem,
        check this line:



        else if(!isset($_SESSION['access']){


        Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:



        if(!isset($_SESSION['access']){
        //Need login to access this page
        }else if($_POST['username'] == $username && $_POST['password'] == $password){
        //Wrong username or password
        }else if ...


        I strongly recommend to change structure of your code:



        Use PHP forwarding instead of JavaScript forwarding



        If you want to forward to the login page when user doesn't have permission to the page, use header like this:



        header('location: /login.php');
        die();


        Always terminate the current script after forward by using die() or exit().



        Check if $_POST key is set before using it



        make sure $_POST set before, For example:



        isset($_POST['username']) && $_POST['username'] == $username


        Don't store raw password in your codes



        Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:



        password_hash("its30305", PASSWORD_DEFAULT);


        and you can use it in your code:



        $username = 'admin';
        $password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm'; //Result of password_hash("its30305", PASSWORD_DEFAULT);


        Read about password_hash



        Use password_verify to verify your password



        You can verify password with password_verify like this:



        isset($_POST['password']) && password_verify($_POST['password'],$password)


        Read about password_verify.



        Show proper message in login page



        If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:



        $_SESSION['login_message'] = 1; //user need to login to see the content
        header('location: /login.php');
        die();


        on login.php:



        if (isset($_SESSION['login_message'])){
        switch ($_SESSION['login_message']){
        case 1:
        echo 'Need to login to see the page.';
        break;
        case 2:
        echo 'Wrong username or password.';
        break;
        }
        //saw the message, not need it anymore!
        unset($_SESSION['login_message']);
        }






        share|improve this answer














        share|improve this answer



        share|improve this answer








        edited Nov 23 '18 at 22:15

























        answered Nov 23 '18 at 22:08









        ICEICE

        1,0721831




        1,0721831






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53449415%2frestrict-user-from-accessing-webpage-incorrect-username-password-alert%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            404 Error Contact Form 7 ajax form submitting

            How to know if a Active Directory user can login interactively

            TypeError: fit_transform() missing 1 required positional argument: 'X'