1) parse error on line #11: Forgot a semi-colon after $_SESSION[valid] = $valid
2) you should put quotes around the array keys for POST and SESSION super global arrays, for instance $POST[op] should be $POST['op'] throughout your script. Otherwise you may get an error of using an undefined CONSTANT.
3) you are checking if ($_POST['op'] == "ds") this value before it has been set.
4) the same is true with what you do on line 14 for if ($_SESSION['valid'] == "yes")
5) Same is true with calling the variable $msg before set
A fix for 4,5,6 is to check to see if it is set. It helps if you indent your code. You will be able to see it better. This might help you. Made a couple of changes.
<?php
// start session
session_start();
// if form submitted
if(isset($_POST['op'])) {
// if form completed
if(!empty($_POST['username']) && !empty($_POST['password'])){
// if invalid username or password
if($_POST['username'] != 'user' || $_POST['password'] != 'pass'){
$msg = '<p style="color:#FF0000; font-family:arial, helvetica,
sans-serif;">Bad Login - Try Again</p>';
// set value
$_SESSION['valid'] = 'invalid';
}
// else valid login
else {
// set session value
$_SESSION['valid'] = 'yes';
// redirect user and exit
header ('location: http://www.site.com/login2.php');
exit;
}
}
// else they forgot to enter username or password
else {
$msg = '<p style="color:#FF0000; font-family:arial, helvetica,
sans-serif;">Please enter username AND password</p>';
}
}
?>
<form method="POST" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<?php if(isset($msg)){ echo $msg; } ?>
<p style="font-size:15px;font-face:arial,helvetica,sans-serif">Username:
<br />
<input type="text" name="username" size="15" maxlength="25" /></p>
<p style="font-size:15px;font-face:arial,helvetica,sans-serif">Password:
<br />
<input type="password" name="password" size="15" maxlength="25" /></p>
<p><input type="submit" name="submit" value="login" /></p>
<input type="hidden" name="op" value="ds" />
</form>
Login2:
<?php
// start session
session_start();
// if not set, or incorrect value:
if(!isset($_SESSION['valid']) || $_SESSION['valid'] != 'yes') {
header ('location: http://www.site.com/login1.php');
exit;
}
// else, good
else {
echo 'you are logged in...';
}
?>
PS: GO BEARS!
