PHP - Login System Gives Blank Page

Can someoneplease help, I need to setup an error page like IF Username and Password are wrong then show an error also if there is no username or password in the fields and I just click LOGIN, I get a blank page?!

Can someone please help me here or point me to a relevant tutorial?

thanks

here is my page:
http://www.retroandvintage.co.uk/default.php

here is my  code:
Code: [Select]
<?php
session_start();
include_once("config.php");

$ebits = ini_get('error_reporting');
error_reporting($ebits ^ E_NOTICE);
/*
Login script:
This script does the following:

Checks that the user is NOT already logged in - if they are they
are redirected to the members page by the 'checkLoggedIn()' function.

Checks if the login form has been submitted - if so, the 'login' and
'password' fields are checked to ensure they are of the correct format and length.
If there are any problems here an error is added to the $messages array and
then the script executes the 'doIndex()' function - this function basically
outputs the main 'index' page for this script - ie the login form.

If there are no problems with the previous step, the 'login' and 'password'
field data is passed to the 'checkPass' function to check that an entry
exists in the 'users' table for that login/password pair.
If nothing is returned from the 'checkPass()' function, an error is
added to the $messages array and the 'doIndex()' function is called as above.

If a row of data is returned from the 'users' table, the data is passed to
the 'cleanMemberSession()' function - which initializes session variables and
logs the user in.  The user is then forwarded to the members page.

If the form hasn't yet been submitted, then the 'doIndex()' function is called
and the login page is displayed.
*/
// Check user not logged in already:
checkLoggedIn("no");

// Page title:
$title="Member Login Page";

// if $submit variable set, login info submitted:
if(isset($_POST["submit"])) {
//
// Check fields were filled in
//
// login must be between 4 and 15 chars containing alphanumeric chars only:
field_validator("rsUser", $_POST["rsUser"], "alphanumeric", 4, 15);
// password must be between 4 and 15 chars - any characters can be used:
field_validator("rsPass", $_POST["rsPass"], "string", 4, 15);

// if there are $messages, errors were found in validating form data
// show the index page (where the messages will be displayed):
if($messages){
doIndex();
// note we have to explicity 'exit' from the script, otherwise
// the lines below will be processed:
exit;
}

// OK if we got this far the form field data was of the right format;
// now check the user/pass pair match those stored in the db:
/*
If checkPass() is successful (ie the login and password are ok),
then $row contains an array of data containing the login name and
password of the user.
If checkPass() is unsuccessful however, $row will simply contain
the value 'false' - and so in that case an error message is
stored in the $messages array which will be displayed to the user.
*/
    if( !($row = checkPass($_POST["rsUser"], $_POST["rsPass"])) ) {
// login/passwd string not correct, create an error message:
        $messages[]="Incorrect login/password, try again";
    }

/*
If there are error $messages, errors were found in validating form data above.
Call the 'doIndex()' function (which displays the login form) and exit.
*/
if($messages){
doIndex();
exit;
}

/*
If we got to this point, there were no errors - start a session using the info
returned from the db:
*/
cleanMemberSession($row["rsUser"], $row["rsPass"]);

// and finally forward user to members page (populating the session id in the URL):
header("Location: main.php");
} else {
// The login form wasn't filled out yet, display the login form for the user to fill in:
doIndex();
}

/*
This function displays the default 'index' page for this script.  This consists of just a simple
login form for the user to submit their username and password.
*/
function doIndex() {
/*
Import the global $messages array.
If any errors were detected above, they will be stored in the $messages array:
*/
global $messages;

/*
also import the $title for the page - note you can normally just declare all globals on one line
- ie:
global $messages, $title;
*/
global $title;
}
// drop out of PHP mode to display the plain HTML:
?>
<!doctype html>
<html>
<head>
<title>List of Pubs and Bars in the UK</title>
<meta name="description" content="Pubs and bars in the UK, nightlife for food and drink" />
<meta name="keywords" content="Pubs, bars, List, uk, nightlife, drinking, drinks, beer, lager, food" />
<meta name="Content-Language" content="en-gb" />
<meta name="robots" content="FOLLOW,INDEX" />
<meta name="revisit-after" content="2 days" />
<meta name="copyright" content="jbiddulph.com" />
<meta name="author" content="John Biddulph - Professional web site design and development in the south of england mainly worthing and brighton" />
<meta name="distribution" content="Global" />
<meta name="resource-type" content="document" />
<link rel="stylesheet" type="text/css" href="css/reset.css" />
<link rel="stylesheet" type="text/css" href="css/ui-lightness/jquery-ui-1.8.6.custom.css" title="default" />
<link rel="alternate stylesheet" type="text/css" href="css/south-street/jquery-ui-1.8.6.custom.css" title="1" />
<link rel="alternate stylesheet" type="text/css" href="css/redmond/jquery-ui-1.8.6.custom.css" title="2" />
<script type="text/javascript" src="js/stylechanger.js"></script>
<script type="text/javascript" src="js/jquery-1.4.2.min.js"></script>
<script type="text/javascript" src="js/jquery-ui-1.8.6.custom.min.js"></script>
<script type="text/javascript">
$(function(){

// Accordion
$("#accordion").accordion({ header: "h3" });

// Tabs
$('#tabs').tabs();


// Dialog
$('#dialog').dialog({
autoOpen: false,
width: 600,
buttons: {
"Ok": function() {
$(this).dialog("close");
},
"Cancel": function() {
$(this).dialog("close");
}
}
});

// Dialog Link
$('#dialog_link').click(function(){
$('#dialog').dialog('open');
return false;
});

// Datepicker
$('#datepicker').datepicker({
inline: true
});


//hover states on the static widgets
$('#dialog_link, ul#icons li').hover(
function() { $(this).addClass('ui-state-hover'); },
function() { $(this).removeClass('ui-state-hover'); }
);

});
</script>
<script type="text/javascript">
function lookup(inputString) {
if(inputString.length == 0) {
// Hide the suggestion box.
$('#suggestions').hide();
} else {
$.post("rpc.php", {queryString: ""+inputString+""}, function(data){
if(data.length >0) {
$('#suggestions').show();
$('#autoSuggestionsList').html(data);
}
});
}
} // lookup

function fill(thisValue) {
$('#inputString').val(thisValue);
setTimeout("$('#suggestions').hide();", 200);
}
</script>
</head>
<body>
<?php if($messages) { displayErrors($messages); }?>
<header>
<div id="title">
<h1>My Pub Space
<a href="#" onClick="setActiveStyleSheet('default'); return false;"><img src="images/0.gif" width="15" height="15" border="0" alt="css style" /></a>&nbsp;<a href="#" onClick="setActiveStyleSheet('1'); return false;"><img src="images/1.gif" width="15" height="15" border="0" alt="css style" /></a>&nbsp;<a href="#" onClick="setActiveStyleSheet('2'); return false;"><img src="images/2.gif" width="15" height="15" border="0" alt="css style" /></a>
<span>
<form method="post" class="textbox" action="search.php">
Town/City:&nbsp;<input type="text" size="26" class="searchbox" value="" name="rsTown" id="inputString" onKeyUp="lookup(this.value);" onBlur="fill();" />

<div class="suggestionsBox" id="suggestions" style="display: none;">
<img src="images/upArrow.png" style="position: relative; top: -36px; left: 105px; z-index:1;" alt="upArrow" />
<div class="suggestionList" id="autoSuggestionsList">
&nbsp; </div>
</div>
<input type="image" src="images/go.png" height="30" with="30" value="GO" />
</form>
</span>
  </h1>
</div>
</header>
<nav>
<ul>
<li class="selected"><a href="default.php">Home</a></li>
<li><a href="#">Pubs</a></li>
<li><a href="#">Members</a></li>
<li><a href="#">Events</a></li>
<li><a href="register.php">Register</a></li>
</ul>
</nav>
<section id="intro">
<header>
<h2>Your social guide to going down the pub, online!</h2>
</header>
<p>Stuck in town with nowhere to go? Not sure if up the road or down the street is best? Need to be somewhere warm, cosy and friendly. Need a drink?....<br />You've come to the right place, mypubspace has it all!</p>
<img src="images/pub.jpg" alt="pub" /> </section>
<div id="content">
<div id="mainContent">
<section>
<article class="blogPost">
<header>
<h2>Pubs and Bars UK Listing</h2>

</header>
<?php

$tableName="pubs";
$targetpage = "default.php"; 
$limit = 20; 

$query = "SELECT COUNT(*) as num FROM $tableName";
$total_pages = mysql_fetch_array(mysql_query($query));
$total_pages = $total_pages['num'];

$stages = 3;
$page = mysql_escape_string($_REQUEST['page']);
if( isset($_REQUEST['page']) && ctype_digit($_REQUEST['page']) ) {
      $page = (int) $_GET['page'];
      $start = ($page - 1) * $limit;
}else{
      $start = 0;   
}

    // Get page data
$query1 = "SELECT * FROM $tableName LIMIT $start, $limit";
$result = mysql_query($query1);

// Initial page num setup
if ($page == 0){$page = 1;}
$prev = $page - 1;
$next = $page + 1;
$lastpage = ceil($total_pages/$limit);
$LastPagem1 = $lastpage - 1;


$paginate = '';
if($lastpage > 1)
{




$paginate .= "<div class='paginate'>";
// Previous
if ($page > 1){
$paginate.= "<a href='$targetpage?page=$prev'>previous</a>";
}else{
$paginate.= "<span class='disabled'>previous</span>"; }



// Pages
if ($lastpage < 7 + ($stages * 2)) // Not enough pages to breaking it up
{
for ($counter = 1; $counter <= $lastpage; $counter++)
{
if ($counter == $page){
$paginate.= "<span class='current'>$counter</span>";
}else{
$paginate.= "<a href='$targetpage?page=$counter'>$counter</a>";}
}
}
elseif($lastpage > 5 + ($stages * 2)) // Enough pages to hide a few?
{
// Beginning only hide later pages
if($page < 1 + ($stages * 2))
{
for ($counter = 1; $counter < 4 + ($stages * 2); $counter++)
{
if ($counter == $page){
$paginate.= "<span class='current'>$counter</span>";
}else{
$paginate.= "<a href='$targetpage?page=$counter'>$counter</a>";}
}
$paginate.= "...";
$paginate.= "<a href='$targetpage?page=$LastPagem1'>$LastPagem1</a>";
$paginate.= "<a href='$targetpage?page=$lastpage'>$lastpage</a>";
}
// Middle hide some front and some back
elseif($lastpage - ($stages * 2) > $page && $page > ($stages * 2))
{
$paginate.= "<a href='$targetpage?page=1'>1</a>";
$paginate.= "<a href='$targetpage?page=2'>2</a>";
$paginate.= "...";
for ($counter = $page - $stages; $counter <= $page + $stages; $counter++)
{
if ($counter == $page){
$paginate.= "<span class='current'>$counter</span>";
}else{
$paginate.= "<a href='$targetpage?page=$counter'>$counter</a>";}
}
$paginate.= "...";
$paginate.= "<a href='$targetpage?page=$LastPagem1'>$LastPagem1</a>";
$paginate.= "<a href='$targetpage?page=$lastpage'>$lastpage</a>";
}
// End only hide early pages
else
{
$paginate.= "<a href='$targetpage?page=1'>1</a>";
$paginate.= "<a href='$targetpage?page=2'>2</a>";
$paginate.= "...";
for ($counter = $lastpage - (2 + ($stages * 2)); $counter <= $lastpage; $counter++)
{
if ($counter == $page){
$paginate.= "<span class='current'>$counter</span>";
}else{
$paginate.= "<a href='$targetpage?page=$counter'>$counter</a>";}
}
}
}

// Next
if ($page < $counter - 1){ 
$paginate.= "<a href='$targetpage?page=$next'>next</a>";
}else{
$paginate.= "<span class='disabled'>next</span>";
}

$paginate.= "</div>";


}
 echo $total_pages.' Results';
 // pagination
 echo $paginate;
?>

<div id="accordion">
<?php 
 

while($row = mysql_fetch_array($result))
{

echo '<div><h3><a href=\"#\">'.$row['rsPubName'].'</a></h3><div>'.$row['rsAddress'].'<br />'.$row['rsTown'].', '.$row['rsCounty'].'<br />'.$row['rsPostCode'].'<br /><br />Region: '.$row['Region'].'<br /><br />Telephone: '.$row['rsTel'].'</div></div>';

}

?>
</div>
</article>
</section>

</div>
<aside>
<section>
<header>
<h3>Members Login Area</h3>
</header>
<form method="post" class="textbox" action="<?php print $_SERVER["PHP_SELF"]; ?>">
Username:&nbsp;<br />
<input type="text" class="textbox" name="rsUser" value="<?php print isset($_POST["rsUser"]) ? $_POST["rsUser"] : "" ; ?>">
Password:&nbsp;<br />
<input type="password" class="textbox" name="rsPass">
<br />
<br />
<input name="submit" class="ui-button ui-widget ui-state-default ui-corner-all ui-button-text-only" type="submit" value="Login">
<br />
</form>
<ul>
<li><button id="button" class="ui-button ui-widget ui-state-default ui-corner-all ui-button-text-only" role="button" aria-disabled="false"><span class="ui-button-text"><a href="register.php">Sign up</a></span></button></li>
<li><button id="button" class="ui-button ui-widget ui-state-default ui-corner-all ui-button-text-only" role="button" aria-disabled="false"><span class="ui-button-text"><a href="forgot.php">Forgot Password</a></span></button></li>
</ul>
</section>
<section>
<header>
<h3>Quick Search</h3>
</header>
<ul>
<li><a href="#">Coming Soon!</a></li>
</ul>
</section>
</aside>
</div>
<footer>
<div>
<section id="about">
<header>
<h3>About</h3>
</header>
<p>My Pub Space is one of the largest and newest UK Pubs and Bars Listing sites online. It is not just a list of pubs, we have added a touch of interactive social pubbing experience online! Once registered, you can view information on pubs in your area, write reviews, organise your evenings out!</p>
</section>
<section id="blogroll">
<header>
<h3>Links</h3>
</header>
<ul>
<li><a href="#">Coming Soon!</a></li>
</ul>
</section>
<section id="popular">
<header>
<h3>Popular</h3>
</header>
<ul>
<li><a href="#">Coming Soon!</a></li>
</ul>
</section>
</div>
</footer>
</body>
</html>

Hey there, have a small issue at hand. My login script keeps returning a blank page. It does a proper echo if you enter an incorrect username or password, but if you enter correct information is returns only a blank page. Here is the code from the php file that checks and processes the username and password the user enters in the form on the login page.



<?php

$host="removed_for_this_post"; // Host name 
$username="removed_for_this_post"; // Database Username 
$password="removed_for_this_post"; // Database password
$db_name="removed_for_this_post"; // Database Name 
$tbl_name="access"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("ALERT! Unable to connect to database!"); 
mysql_select_db("$db_name")or die("ALERT! Unable to select database!");

// Username and password sent from form 
$username=$_POST['username']; 
$pass=$_POST['pass'];

// To protect against MySQL injection
$username = stripslashes($username);
$pass = stripslashes($pass);
$username = mysql_real_escape_string($username);
$pass = mysql_real_escape_string($pass);

$query="SELECT * FROM $tbl_name WHERE username='$username' and password='$pass'";
$result=mysql_query($query);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);

if($count==1){
// Register $username, $pass and redirect to main database page
session_register("username");
session_register("pass"); 
header("location: main_interface.php");
}
else {
echo "Wrong Username or Password, please check check your credentials.";
}
?>


Thank you in advance for your assistance!

My main pages looks like this...

<?php
include "header.php";

CONTENT

include "footer.php";
?>

On the header will be my login script so on every page the script will be there so they can log in from anywhere on the site. Also, I want it all done on one page instead of being directed somewhere else. This is the code below.

<?php
session_start();

$message = ""; //error message needs to be blank
$loginstatus = ""; //error message needs to be blank

//if $_POST "username" and "password" exist, check for consistency.
if (isset($_POST['username'])&&($_POST['password']))
{
include 'connect.php'; //connect
$username = mysql_real_escape_string($_POST['username']); //set variables from session
$password = mysql_real_escape_string($_POST['password']); //set variables from session

//remove slashes and HTML
$username = stripslashes($username);
$password = stripslashes($password);
$username = strip_tags($username);
$password = strip_tags($password);

$password = md5($password); //md5 encryption

$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); //checking if row exists that has $username and $password together.
$num = mysql_num_rows($query); //number of rows. if not equal to one login will fail.

if($num==1)
{
$_SESSION['username'] = $username; //store session data
$message = "$username, you are logged in!";
}
else
{
$message = "<font color='red'>Wrong Username or Password. Please try again.</font>";
}
}

//if $_SESSION "username" and "password" exist, check for consistency.
if (isset($_SESSION['username']))
{
$username = $_SESSION['username'];
$loginstatus = "
<table cellspacing='0' cellpadding='0'>
<tr>
<td align='right'><b>$message</b> <a href='logout.php'>[logout]</a></td>
</tr>
</table>
";
}
else
{
$loginstatus = "
<b>$message</b>
<table cellspacing='0' cellpadding='0'>
<form action='CURRENTPAGE.php' method='post'>
<tr>
<td><b>Username: </td>
<td><input type='text' name='username' class='inputbox'></td>
<td>   <b>Password: </td>
<td><input type='password' name='password' class='inputbox'></td>
<td>   <input type='submit' value='Log In' class='submitbutton'></td>
</tr>
</table>
</form>
";
}

echo $loginstatus;

?>

I have two questions...

#1 How can I direct my page when entering the password to the current page the user is on? (look at CURRENTPAGE.php in the code for reference)

#2 Security is obviously an issue at all times. How does my security look? What can I do to make this login script more secure?

Thanks so much for all of those who help out. I'll be watching this forum all day everyday.

This is my one page log in system. Using this on the header so guests can log in on ANY page. Let me know what you think needs improving for security. I'm also wondering if putting the include "disconnect.php"; where I have is correct. Thanks!

Code: [Select]
<?php
session_start();

$message = ""; //error message needs to be blank
$loginstatus = ""; //error message needs to be blank

//if $_POST "username" and "password" exist, check for consistency.
if (isset($_POST['username'])&&($_POST['password']))
{
include 'connect.php'; //connect
$username = mysql_real_escape_string($_POST['username']); //set variables from session
$password = mysql_real_escape_string($_POST['password']); //set variables from session

//remove slashes and HTML
$username = stripslashes($username);
$password = stripslashes($password);
$username = strip_tags($username);
$password = strip_tags($password);

$password = md5($password); //md5 encryption

$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); //checking if row exists that has $username and $password together.
$num = mysql_num_rows($query); //number of rows. if not equal to one login will fail.

if($num==1)
{
$_SESSION['username'] = $username; //store session data
$message = "$username, you are logged in!";
include "disconnect.php";
}
else
{
$message = "<font color='red'>Wrong Username or Password. Please try again.</font>";
}
}

//if $_SESSION "username" and "password" exist, check for consistency.
if (isset($_SESSION['username']))
{
$username = $_SESSION['username'];
$loginstatus = "
<table cellspacing='0' cellpadding='0'>
<tr>
<td align='right'><b>$message</b> <a href='logout.php'>[logout]</a></td>
</tr>
</table>
";
}
else
{
$loginstatus = "
<b>$message</b>
<table cellspacing='0' cellpadding='0'>
<form action='index.php' method='post'>
<tr>
<td><b>Username: </td>
<td><input type='text' name='username' class='inputbox'></td>
<td>   <b>Password: </td>
<td><input type='password' name='password' class='inputbox'></td>
<td>   <input type='submit' value='Log In' class='submitbutton'></td>
</tr>
</table>
</form>
";
}

echo $loginstatus;
?>

Hi guy's,

I'm having problems adjusting a script to add a level (user rights) function. When i login with a admin or normal user it gives a blank page (not redirecting to home.php). It even does'nt return an echo that user / pass is incorrect. I'm breaking my head over this for day's now. Can you help me out?

Code: [Select]
<?php
session_start();

//Login form (index.php)

include "db_connect.php";
if(!$_POST['submit'])
{
?>

<html>
<head>
<!--[if IE]>
<link rel="stylesheet" type="text/css" href="style.css" />
<![endif]-->
<![if !IE]>
<link rel="stylesheet" type="text/css" href="firefox.css" />
<![endif]>
</head>
<body>
<div id="wrapper">
<div id="header">
<?php include('header.php'); ?>
</div>
<div class="divider">

<strong>Login</strong>
<form method="post" action="index.php">

<div class="formElm">
<label for="username">Klantnummer:</label>
<input id="username" type="text" name="username" maxlength="16">
</div>

<div class="formElm">
<label for="password">Wachtwoord:</label>
<input type="password" name="password" maxlength="16">
</div>

<input type="submit" name="submit" value="Login">
</form>

</div>
<div id="footer"> 
<?php include('footer.php'); ?>
</div>
</div>
</html>

<?php
}
else
{
  $user = protect($_POST['username']);
  $pass = protect($_POST['password']);
  $level = protect($_POST['level']);
 
if($user && $pass && $level)
{
$pass = md5($pass); //compare the encrypted password
$sql1 ="SELECT id,username FROM `users` WHERE `username`='$user' AND `password`='$pass' AND `level`='1'"; 
$sql2 ="SELECT id,username FROM `users` WHERE `username`='$user' AND `password`='$pass' AND `level`='9'";
$queryN=mysql_query($sql1) or die(mysql_error());
$queryA=mysql_query($sql2) or die(mysql_error());

if(mysql_num_rows($queryN) == 1)
    {
      $resultN = mysql_fetch_assoc($queryN);
  $_SESSION['id'] = $resultN['id'];
      $_SESSION['username'] = $resultN['username'];   
header("location:home.php");     
    }
    elseif(mysql_num_rows($queryA) == 1)
    {
      $resultA = mysql_fetch_assoc($queryA); 
  $_SESSION['id'] = $resultA['id'];
      $_SESSION['username'] = $resultA['username'];  
header("location:home.php"); 
}

else{
echo "Wrong Username or Password";
}
}
}
?>
and the mysql code:

Code: [Select]
CREATE TABLE `user` (
  `id` int(4) unsigned NOT NULL auto_increment,
  `username` varchar(32) NOT NULL,
  `password` varchar(32) NOT NULL,
  `level` int(4) default '1',
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=latin1;