Index.php causing empty alert on live website - php

Question

So I have index.php has my default page. It works fine on xampp. So I uploaded my whole site to 1&1 (my domain/hosting provider) and when I try to go to my domain I get an empty alert with no message and a completely blank page.
I changed the name of the file to index.html and the webpage loaded just fine. So I know it must be something with the .php extention or my code up top.
I also added a file called .htaccess and it contains only:
DirectoryIndex index.php
Here is my php code at the top of index.php (replaced sensitive infow with *s):
<?php
//Connect to a database
$host_name = "******.db.1and1.com";
$database = "db****";
$user_name = "dbo******";
$password = "***z.0**";
$connect = mysqli_connect($host_name, $user_name, $password, $database);
// echo("nice job");
//Take the values from the html form and assign them to variables
$ID = $_POST['name'];
$userpassword = $_POST['password'];
//If no passsowrd entered then go straight to index.php
echo "<script type='text/javascript'>alert($userpassword);</script>";
if ($userpassword == null) {
header("Location: http://localhost:82/index3.php");
die();
}
//Check to see if the password matches the hashes
if (md5($userpassword) === '******************'
or md5($userpassword) === '***********'
or md5($userpassword) === '****************'
or md5($userpassword) === '**************')
{
//Add the visitor name to our list
mysqli_query($connect, "INSERT INTO `WebsiteVisitors` (`Name`) VALUES ('$ID')") or die("Error in INSERT: ".mysqli_error($connect));
// echo "You have entered the correct password, congrats.";
// Start the session so they can access other pages
session_start();
$_SESSION['loggedIn'] = true;
// Redirect them to rest of site
header("Location: http://localhost:82/home.php");
die();
}
else {
header("Refresh: 0; url=index2.php");
echo "<script type='text/javascript'>alert(\"Wrong Password. Check your invitation card.\");</script>";
}
?>

Answer 1

Since $_POST request comes only after submitting form in your case, you need to only execute the username and password checks if $_POST["name"] and $_POST["password"] exists.
So give an if statement if(isset($_POST['name']) && isset($_POST['password'])) before using and manipulating $_POST variables. Alson session_start() should be given at top of your script.
Below is your complete code including the check
<?php
session_start();
// session start should be at top of your script
error_reporting(E_ERROR); // reports only errors
//Connect to a database
$host_name = "******.db.1and1.com";
$database = "db****";
$user_name = "dbo******";
$password = "***z.0**";
$connect = mysqli_connect($host_name, $user_name, $password, $database);
// $_POST request comes only when form is submitted in your case. So check for $_POST['name'] and $_POST['password']
if(isset($_POST['name']) && isset($_POST['password']))
{
$ID = $_POST['name'];
$userpassword = $_POST['password'];
//If no passsowrd entered then go straight to index.php
if ($userpassword == null)
{
echo "<script type='text/javascript'>alert("Empty Password");</script>";
header("Location: http://localhost:82/index3.php");
die();
}
//Check to see if the password matches the hashes
if (md5($userpassword) === '******************'
or md5($userpassword) === '***********'
or md5($userpassword) === '****************'
or md5($userpassword) === '**************')
{
//Add the visitor name to our list
mysqli_query($connect, "INSERT INTO `WebsiteVisitors` (`Name`) VALUES ('$ID')") or die("Error in INSERT: ".mysqli_error($connect));
$_SESSION['loggedIn'] = true;
// Redirect them to rest of site
header("Location: http://localhost:82/home.php");
die();
}
else
{
echo "<script type='text/javascript'>alert(\"Wrong Password. Check your invitation card.\");</script>";
header("Refresh: 0; url=index2.php");
}
}
?>