$_FILE APPLY IN $_poST - php

Question

I am a beginner in PHP and just starting to learn it. I am trying to make a registration page and login page. My login page is working once I select username and password and it also can detect an incorrect password but the profile picture that I uploaded through the registration page is not appearing on the welcome page. Once I add the profile, the login page no longer works at all. I hope you guys can understand my problem and help me find a solution. Thank you in advance. I attach my code below :
REGISTER FORM PHP
<?php
session_start();
$_SESSION['message'] = '';
$mysqli=new MySQLi('127.0.0.1','root','','accounts');
if($_SERVER["REQUEST_METHOD"] == "POST") {
if ($_POST['password']== $_POST['confirmpassword']) {
$username = $mysqli->real_escape_string($_POST['username']);
$email = $mysqli->real_escape_string($_POST['email']);
$password = md5($_POST['password']);
$profile_path = $mysqli->real_escape_string('images/'.$_FILES['profile']['name']);
if (preg_match("!image!", $_FILES['profile']['type'])) {
if (copy($_FILES['profile']['tmp_name'],$profile_path)){
$_SESSION['username'] =$username;
$_SESSION['profile'] =$profile_path;
$sql ="INSERT INTO users(username,email,password,profile)"
."VALUES ('$username','$email','$password','$profile_path')";
if($mysqli->query($sql)=== true) {
$_SESSION['message'] = 'Registration successful!
Added $username to the database!';
header("location:RegisterLogin.php");
}
else {
$_SESSION['message'] = "User could not be added to the database!";
}
}
else{
$_SESSION['message'] = "file failed!";
}
}
else {
$_SESSION['message'] = "Please only upload GIF,JPG, or PNG images!";
}
}
else{
$_SESSION['message'] = "two password do not match!";
}
}
?>
lOGIN fORM
<?php
session_start();
$_SESSION['message']='';
$mysqli=new MySQLi('127.0.0.1','root','','accounts');
if(isset($_POST['login'])) {
$username = $mysqli->real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$profile_path = $mysqli->real_escape_string(isset($_FILES['profile']));
$sql="SELECT * FROM users WHERE username='$username' AND password='$password' AND profile = 'profile_path'";
$result = mysqli_query($mysqli,$sql);
if(mysqli_affected_rows($mysqli) == 1){
$_SESSION['username'] = $username;
$_SESSION['profile'] = $profile_path;
$_SESSION['message'] = "Registration successful!";
header("location:Welcome.php");
}
else{
$_SESSION['message'] = "Login Failed!";
}
}
?>
WELCOME PHP
<link rel="stylesheet" href="Form2.css" />
<?php session_start(); ?>
<div class="body content">
<div class="welcome">
<div class="alert alert-success"><?= $_SESSION['message']?></div>
Welcome To Your Profile <span class="user"><img src='<?=$_SESSION['profile']?>'</span>

Answer 1

update your codes like following
REGISTER FORM
<?php
session_start();
$_SESSION['message'] = '';
$mysqli= new mysqli('127.0.0.1','root','','accounts');
if(isset($_POST) && array_filter($_POST)){
if ($_POST['password'] == $_POST['confirmpassword']) {
$username = $mysqli->real_escape_string($_POST['username']);
$email = $mysqli->real_escape_string($_POST['email']);
$password = md5($_POST['password']);
$profile_path = $mysqli->real_escape_string('images/'.$_FILES['profile']['name']);
if(!empty($username) && !empty($email) && !empty($password) && !empty($_FILES['profile']['name']){
if (preg_match("!image!", $_FILES['profile']['type'])) {
if (move_uploaded_file($_FILES['profile']['tmp_name'],$profile_path)){
$_SESSION['username'] = $username;
$_SESSION['profile'] = $profile_path;
$sql ="INSERT INTO users(username,email,password,profile) VALUES ('$username','$email','$password','$profile_path')";
if($mysqli->query($sql) == true) {
$_SESSION['message'] = "Registration successful! Added $username to the database!";
header("Location: RegisterLogin.php");
}
else { $_SESSION['message'] = "User could not be added to the database!"; }
} else {$_SESSION['message'] = "file failed!";}
} else { $_SESSION['message'] = "Please only upload GIF,JPG, or PNG images!"; }
}else{ $_SESSION['message'] = "values are missing"; }
} else{ $_SESSION['message'] = "two password do not match!"; }
}
?>
LOGIN FORM
<?php
session_start();
$_SESSION['message']='';
$mysqli= new mysqli('127.0.0.1','root','','accounts'););
if(isset($_POST['login'])){
$username = $mysqli->real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$sql="SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = $mysqli->query($sql);
if($result->num_rows > 0){
$row = $result->fetch_assoc();
$_SESSION['username'] = $username;
$_SESSION['profile'] = 'images/'.$row['profile'];
$_SESSION['message'] = "Login successful!";
header("Location: Welcome.php");
}else{ $_SESSION['message'] = "Login Failed!";}
}
?>
WELCOME PHP
<?php session_start(); ?>
<link rel="stylesheet" href="Form2.css" />
<div class="body content">
<div class="welcome">
<div class="alert alert-success"><?= $_SESSION['message']?></div>
Welcome To Your Profile <span class="user"><img src='<?=$_SESSION['profile'];?>'/></span>

Answer 2

You are setting your session values incorrectly in login.php. In the below code, uses mysqli_fetch_array() to retrieve correct values for $_SESSION variable.
Login.php
Try this:
<?php
session_start();
$_SESSION['message']='';
$mysqli=new MySQLi('127.0.0.1','root','','accounts');
if(isset($_POST['login'])) {
$username = $mysqli->real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$sql="SELECT * FROM users WHERE username='$username' AND password='$password' LIMIT 1;";
$result = mysqli_query($mysqli,$sql);
if(mysqli_num_rows($result)>0){
$row = mysqli_fetch_array($result);
$_SESSION['username'] = $row['username'];
$_SESSION['profile'] = $row['profile'];
$_SESSION['message'] = "Registration successful!";
header("location:Welcome.php");exit();
}
else{
$_SESSION['message'] = "Login Failed!";
}
}
?>
In Welcome.php
Move <?php session_start(); ?> to the topmost of your document. You cannot output anything (HTML content or echos) before calling session_start() or session will fail unless using output buffering.