php wont direct me to the 'action' page - php

Question

I have two pages which are (sigin.php , validateIn.php)
the form the is submitted by the user in the 'signin' page, then gets validated in the 'validateIn' page.
The problem is that the server doesn't redirect me to the 'validateIn' page and it just reloads the current page 'signin'.
I have included the action attribute in the form tag.
I have tried using the header('Location:***.php) function
none of these worked for me.
I have included a number of "echo" statements to know the path of the compiler.
Signin.php
<form action="validateIn.php" method="POST">
<strong> <label> Student Number: </strong>
<input id="studentNumber" type="text" name="studentNumber"
value="<?php echo isset($_POST['studentNumber']) ? $_POST['studentNumber'] : '' ?>">
</label> <br>
<strong> <label> Password: </strong>
<input id="pass" type="password" name="pass">
</label> <br>
<input id="signin" type="submit" name="signin" value="Sign In" >
</form>
vaildateIn.php
<?php
if (isset($_POST['signin'])) { //if 1
echo "if number 1 <br>";
if(!empty($_POST['studentNumber']) && !empty($_POST['pass']) ){ //if 2
echo "if number 2";
$number = mysqli_real_escape_string($_POST['studentNumber']);
$pass = mysqli_real_escape_string(md5($_POST['pass']));
$sql = "SELECT * FROM students WHERE student_number=$number AND password=$pass";
$result = mysqli_query($$conn, $sql);
if (mysqli_num_rows($result) == 1) { //if 3
echo "if number 3";
header('Location:home.php');
} else { //else 1
echo "else number 1";
header('Location:signin.php');
}
}
}
else{
echo "else number 2";
}

Answer 1

To add the hashed version of the user's password to the database, semi-pseudo code might be:
<form method='post'>
<label>username:<input type='text' name='username' /></label>
<label>studentNumber:<input type='text' name='studentNumber' /></label>
<label>password:<input type='password' name='pass' /></label>
<input type='submit' />
</form>
<?php
if( $_SERVER['REQUEST_METHOD']=='POST' ){
$args=array(
'studentNumber' => FILTER_SANITIZE_STRING,
'username' => FILTER_SANITIZE_STRING,
'pass' => FILTER_SANITIZE_STRING
);
$_POST=filter_input_array( INPUT_POST, $args );
extract( $_POST );
$pwdhash=password_hash( $pass, PASSWORD_DEFAULT );
$sql='insert into `student` set `username`=? `student_number`=?, `password`=?';
$stmt=$db->prepare( $sql );
$stmt->bind_param('sss', $username, $studentNumber, $pwdhash );
$stmt->execute();
}
?>
If you were to assume that passwords had been stored in the database as correctly formed hashes using password_hash then the approach you would use to verify the user credentials could be like this:
<form action="validateIn.php" method="POST">
<label>
<strong>Student Number: </strong>
<input type="text" name="studentNumber" value="<?php echo isset( $_POST['studentNumber'] ) ? $_POST['studentNumber'] : '' ?>" />
</label>
<br />
<label>
<strong>Password:</strong>
<input type="password" name="pass" />
</label>
<br />
<input type="submit" value="Sign In" />
</form>
if( $_SERVER['REQUEST_METHOD']=='POST' ){
$args=array(
'studentNumber' => FILTER_SANITIZE_STRING,
'pass' => FILTER_SANITIZE_STRING
);
$_POST=filter_input_array( INPUT_POST, $args );
extract( $_POST );
if( isset( $studentNumber, $pass ) ){
$sql='select `password` from `student` where `student_number`=?';
$stmt=$db->prepare( $sql );
$stmt->bind_param( 's', $studentNumber );
$res=$stmt->execute();
if( $res ){
$stmt->store_result();
$stmt->bind_result( $pwdhash );
$stmt->fetch();
$stmt->free_result();
$stmt->close();
if( $pwdhash == password_verify( $pass, $pwdhash ) ){
/* ok - redirect accordingly */
}else{
/* bogus - */
}
}
}
}
With regards to the logic used in your form and validateIn.php script - this appears to work fine for me ( removed all the db calls though ) - hope this all proves of some help but I will say that you are wrong to assume that security is not important in your project as it is just a school exercise.... never too early to adopt best practise '-)
<?php
if( $_SERVER['REQUEST_METHOD']=='POST' ){
/* POST to same page to emulate posting to validateIn.php */
if( isset( $_POST['signin'] ) ) {
echo "if number 1 <br>";
if( isset( $_POST['studentNumber'], $_POST['pass'] ) && !empty( $_POST['studentNumber'] ) && !empty( $_POST['pass'] ) ){
echo "if number 2";
} else {
echo 'Bogus - empty or missing fields';
}
} else{
echo "else number 2";
}
}
?>
<!DOCTYPE html>
<html lang='en'>
<head>
<meta charset='utf-8' />
<title></title>
</head>
<body>
<form method="POST">
<label>
<strong>Student Number: </strong>
<input type="text" name="studentNumber" value="<?php echo isset( $_POST['studentNumber'] ) ? $_POST['studentNumber'] : '' ?>" />
</label>
<br />
<label>
<strong>Password:</strong>
<input type="password" name="pass" />
</label>
<br />
<input type="submit" name='signin' value="Sign In" />
</form>
</body>
</html>