0

im creating a login page which is there are different multi user can login such as student, manager and stuff.. when im trying to run my code, it shows empty page, can anyone help with my code? im new in php and mysqli code below shows the image of my database enter image description here

<?php
    require('db.php');
    session_start();
    // If form submitted, insert values into the database.
    if (isset($_POST['username'])){

        $username = stripslashes($_REQUEST['username']); // removes backslashes
        $username = mysqli_real_escape_string($con,$username); //escapes special characters in a string
        $password = stripslashes($_REQUEST['password']);
        $password = mysqli_real_escape_string($con,$password);

    //Checking is user existing in the database or not
        $query = "SELECT * FROM `users` WHERE username='$username' and password='".md5($password)."'";
        $result = mysqli_query($con,$query) or die(mysql_error());
        $rows = mysqli_num_rows($result);

        if($rows==1)
        {
            if($rows ['level'] == "student")
            {
                header("localtion: student.php");
            }
            elseif($rows ['level'] == "manager")
            {
                header("location: manager.php");
            }
        }
        else
        {
            echo "wrong Username or Password";
        }
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Login</title>
<link rel="stylesheet" href="css2/style.css" />
</head>
<body>

<div class="form">
<h1>Log In</h1>
<form action="" method="post" name="login">
<input type="text" name="username" placeholder="Username" required />
<input type="password" name="password" placeholder="Password" required />
<input name="submit" type="submit" value="Login" />
</form>
<p>Not registered yet? <a href='registration.php'>Register Here</a></p>

</div>
<?php } ?>


</body>
</html>
Your Common Sense
  • 154,967
  • 38
  • 205
  • 325
ying yang
  • 11
  • 3
  • Apart of the problem which you have there is another one.. this is now how `mysqli_*` is supposed to be used.. – S.I. Oct 17 '16 at 04:56
  • 1
    Side note, look into `password_hash()`/`password_verify()`, `md5()` is not sufficient for password verifying. Also, you should be putting `exit;` after your redirects. – Rasclatt Oct 17 '16 at 05:00
  • @S.I. is probably referring to using parameterized queries. [The answer to this question](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) explains about them. –  Oct 17 '16 at 05:05
  • @Terminus, yes. – S.I. Oct 17 '16 at 05:08

1 Answers1

-1

There is an extra <?php } ?> (3rd line from last).

It should be just before ?> <!DOCTYPE html>

i.e it should be like: } ?> <!DOCTYPE html>

Dipanwita Kundu
  • 1,639
  • 1
  • 8
  • 14