php login page failure

BioMash

I have a windows 2003 server running php 4.3.4. I have several sites running php without problem but a new one upoaded today will not allow me to login. When I use the login page it just refreshes without login in.

The code on the login page is this:

if(isset($_POST[s2]))
{
	$MyUsername1 = strip_tags($_POST[username1]);
	$MyPassword1 = strip_tags($_POST[password1]);

if(empty($MyUsername1) || empty($MyPassword1))
{

	$MyError = "<center><font color=red size=2 face=verdana><b>All fields are required!</b></font></center>";

}
else
{
	//check the login info if exists
	$q1 = "select * from weblinks_admin where AdminUsername = '$MyUsername1' and AdminPassword = '$MyPassword1' ";
	$r1 = mysql_query($q1) or die(mysql_error());

	if(mysql_num_rows($r1) == '1')
	{
		$a1 = mysql_fetch_array($r1);
		$_SESSION[AdminID] = $a1[AdminID];
		header("location:index.php");
		exit();
	}
}
}

Can someone point me int the right direction, is it a code problem or an IIS 6 setting that I have wrong, and how do I go about tracking down the problem.

As you can proibably guess, my experience with PHP is very limited and I am just looking for some pointers.

I have checked this sites settings against other php site I have running and can not see any differences.

Thanks in advance

LarsLai

hi!
is there any output to the browser before

header("location:index.php");

if there is the header will not work.
and as you say

$MyError = "<center><font color=red size=2 face=verdana><b>All fields are required!</b></font></center>";

in case of an error I guess you send <html> on top of your page?

PHPMagician

Refreshing to me is a good sign that the the login is successful. Maybe index.php is named something differently, or has no default content.

Also, please note that this script seems to be vulnerable to SQL Injection. This will depend on you configuration (basically, if magic_quotes_gpc is On or Off).

Submit the form, without a username and/or a password. If you don't get the custom error message within the code outputted then something is wrong.

BioMash

ok, if i enter nothing in the fields it displays the error mesage 'all fields are required' so it looks as though the code works.

I have also spoken with somebody running the same code on a non windows machine and it works fine.

There seems to be no output to the browser, the page just appears to refresh.

I have included the whole code below:
index.php

<?
require_once("../conn.php");
require_once("access.php");
require_once("../includes.php");
require_once("AdminNavigation.php");
?>

<?
require_once("../conn.php");
require_once("../includes.php");

if(isset($_POST[s2]))
{
	$MyUsername1 = strip_tags($_POST[username1]);
	$MyPassword1 = strip_tags($_POST[password1]);	

if(empty($MyUsername1) || empty($MyPassword1))
{
	$MyError = "<center><font color=red size=2 face=verdana><b>All fields are required!</b></font></center>";
}
else
{
	//check the login info if exists

	$q1 = "select * from weblinks_admin where AdminUsername = '$MyUsername1' and AdminPassword = '$MyPassword1' ";
	$r1 = mysql_query($q1) or die(mysql_error());

	if(mysql_num_rows($r1) == '1')
	{
		$a1 = mysql_fetch_array($r1);
		$_SESSION[AdminID] = $a1[AdminID];
		header("location:index.php");
		exit();
	}
}
}
?>
<html>
<head>
<title>Admin Panel</title>
<style>
	body {font-family:verdana; font-size:12; font-weight:bold; color:black; background-color:white}
	td  {font-family:verdana; font-size:12; font-weight:bold; color:black}
</style>
</head>
<body onload="document.f1.username1.focus();">

<!-- main table start here -->

<table width=761 height=500 align=center  border=1 bordercolor=black cellspacing=0 cellpadding=0>
<tr>
	<td align=center>

		<!-- second table start here -->

		<table width="757" border="0" cellspacing="0" cellpadding="0" height="100%" bgcolor=white>
		<tr>
			<td align=center>
				<form method=post action="login.php" name=f1>
				<table align=center width=400 border=1 bordercolor=black cellspacing=0 cellpadding=5>
				<caption align=center><?=$MyError?></center>
				<tr bgcolor=#CCCCCC>
					<td colspan=2 align=center><b><font size="+1">Login form</font></b></td>
				</tr>
				<tr bgcolor=#CACED7>
					<td>Username: <font size="1"></font></td>
					<td><input type=text name=username1 maxlength=20></td>
				</tr>
				<tr bgcolor=#CACED7>
					<td>Password: <font size="1"></font></td>
					<td><input type=password name=password1 maxlength=20></td>
				</tr>
				</table>	

				<br><center><input type=submit name=s2 value="Login" style="background-color:#6598CD; font-size:11; color:black; font-family:verdana, arial; font-weight:bold; border-width:1; border-color:black"></center>
				</form>
		</table>
		<!-- second table end here -->
</td>
</tr>
</table>
<!-- main table end here -->

PHPMagician

Try:

header('Location: http://www.yoursite.com/index.php');

So it is not a relative URI.