Need help (header error)

Discussion in 'PHP' started by luckmann, Sep 10, 2010.

0
  1. #1
    what's wrong with this? i keep getting 

    Warning: Cannot modify header information - headers already sent by (output started at /home/*****i/public_html/***/***/****/*****.php:1) in /home/****/public_html/******/******/admin.php on line 57
    Code (markup):
    <?php
	session_start();
    require_once("includes/dbconnect.php"); //Load the settings
	require_once("includes/functions.php"); //Load the functions
	$msg="";
	
	//LOGIN VARIABLES
	$username = (!empty($_REQUEST['username']))?strip_tags(str_replace("'","`",$_REQUEST['username'])):'';
	$password = (!empty($_REQUEST['password']))?strip_tags(str_replace("'","`",$_REQUEST['password'])):'';
	
	// LOGIN
	if(!empty($_REQUEST["login"]) && $_REQUEST['login']=="yes"){
		if($username=="" || $password=="")
		{
			$msg = "Empty username and/or password.";
			
		} else {
		
		
			$sSQL = "SELECT * FROM `bs_settings` WHERE `username`='".$username."'";
			$result = mysql_query($sSQL) or die("Invalid query: " . mysql_error());	
			if(mysql_num_rows($result)>0){
				$row=mysql_fetch_assoc($result);
	
				if(md5($password)!=$row["password"]){
						$msg = "Wrong username and/or password";
				} else {
				
					$_SESSION['idUser']= $row["id"];
					$_SESSION['username']= $row["username"];
					$_SESSION['accesslevel']= 1899;
					$_SESSION['logged_in'] = true;

					//addLog($row["id"],"Successfully logged in.");
				}
				
			} else {
				$msg = "Wrong username (username) and/or password";
			}
		} 
	}
	
	if($_SESSION["logged_in"]==true){ 
	header("Location: admin-index.php");
	} else {
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
<title>Booking System v1.2</title>
<link rel="stylesheet" href="css/bs-admin.css" type="text/css" />
</head>
<body>
<div id="content">
<h1>Admin</h1>
    <div class="login_container"> 
        <div class="login">
        <?php echo $msg; ?>
        <form method="post" action="admin.php" enctype="multipart/form-data"  name="ff1">
                
                    
                    Username: <input type="text" id="username" name="username" size="30" /><br />
                    Password: &nbsp;<input type="password" id="password" name="password"  size="30" /><br />
                    
                    <input type="submit" name="submit" value="Submit" tabindex="2"/>			
                
                    <input type="hidden" value="yes" name="login"  />
        </form>
        </div>
    </div>
</div>
</body>
</html>
<?php  } ?>
    PHP:

    thank you
     
    luckmann, Sep 10, 2010 IP
  2. HungryMinds

    HungryMinds Active Member

    Messages:
    216
    Likes Received:
    2
    Best Answers:
    1
    Trophy Points:
    63
    #2
    Hi!

    Try This Command At Top Of Your Page And At Bottom Of Your Page.

    <?php
    // At Start Page
    ob_start();
    ?>

    All Your PHP Or HTML CODE

    <?php
    // At End Page
    ob_flush();
    ?>
     
    HungryMinds, Sep 10, 2010 IP
    luckmann likes this.
  3. luckmann

    luckmann Peon

    Messages:
    272
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    wow thank you :) it worked like a charm
     
    luckmann, Sep 10, 2010 IP
  4. HungryMinds

    HungryMinds Active Member

    Messages:
    216
    Likes Received:
    2
    Best Answers:
    1
    Trophy Points:
    63
    #4
    Your Most Welcome My Friend :)
     
    HungryMinds, Sep 10, 2010 IP
  5. danx10

    danx10 Peon

    Messages:
    1,179
    Likes Received:
    44
    Best Answers:
    2
    Trophy Points:
    0
    #5
    You should escape user submitted input before using it within querys.

    Replace:

    $username = (!empty($_REQUEST['username']))?strip_tags(str_replace("'","`",$_REQUEST['username'])):'';
$password = (!empty($_REQUEST['password']))?strip_tags(str_replace("'","`",$_REQUEST['password'])):'';
    PHP:
    With:

    
$username = (!empty($_REQUEST['username'])) ? mysql_real_escape_string(strip_tags($_REQUEST['username'])) : '';
$password = (!empty($_REQUEST['password'])) ? mysql_real_escape_string(strip_tags($_REQUEST['password'])) : '';
    PHP:
    Also; although their aint much significiant difference I'd use ob_end_flush(); over ob_flush(), and unless your expecting the requests to be from either $_GET or $_POST I'd define which (instead of using $_REQUEST).
     
    danx10, Sep 10, 2010 IP