PHP basic form validation - php

Question

I'm building a website that is password-protected but I can't seem get it to work properly. I have it set to go to the homepage if the password is correct & to a different page if the password is incorrect. I have written the code but every time I run it, it goes right to the page that displays if the password is wrong. I know something is missing from the code but I'm not sure what it is.
HTML
<table>
<form action="index.php" method="post">
<tr>
<td><input type="password" name="password" /></td>
<td><input type="submit" name="submit" value="Request Permission" /></td>
</tr>
</form>
</table>
PHP
$pass = $_POST['password'];
if ($pass == "Password") {
header('Location:home.php');
} else {
header('Location:wrong.php');
exit;
}
Can you please help me?

Answer 1

You're not checking to see if the form is submitted. You're just going straight into your logic.
And easy way to check to see if the page has received a form submission is to check the request method.
if('POST' === $_SERVER['REQUEST_METHOD']) {
$pass = $_POST['password'];
if ($pass == "Password") {
header('Location:home.php');
} else {
header('Location:wrong.php');
exit;
}
}
You can also check to see if $_POST['submit'] is set and has a value.
FYI, might want to put an exit after the first call to header(). Also, this isn't a great way to go about checking passwords. Might want to consider using a database and hashed passwords. You should also add some data validation (i.e. make sure the password field isn't blank).

Answer 2

add this around your PHP:
if(isset($_POST['submit'])) {
}
It'll work fine then, upon page load the code is being read, and as $_POST['password'] has no value at this stage you're being redirected to wrong.php.

Answer 3

Try this
if('POST' === $_SERVER['REQUEST_METHOD']) {
$pass = $_POST['password'];
if ($pass == "Password") {
header('Location:home.php');
} else {
header('Location:wrong.php');
exit;
}
}
else{
echo'<table>
<form action="index.php" method="post">
<tr>
<td><input type="password" name="password" /></td>
<td><input type="submit" name="submit" value="Request Permission" /></td>
</tr>
</form>
</table>';
}

Answer 4

Consider the following system with the following pages:
index.php - here we will have our login form
<?php
session_start();
if ((isset($_POST['password']) && $_POST['password'] == "Password") || $_SESSION['auth'] == 1)
{
header('Location:home.php');
}
else
{
header('Location:wrong.php');
}
?>
<table>
<form action="index.php" method="post">
<tr>
<td><input type="password" name="password" /></td>
<td><input type="submit" name="submit" value="Request Permission" /></td>
</tr>
</form>
</table>
Your home.php file
<?php
session_start();
if ($_GET['logout'] == 1)
{
session_destroy();
}
if ($_SESSION['auth'] == 1)
{
//show stuff to the logged in user
//display log-out option
echo 'Logout';
}
else
{
//redirect the user to the login page
header('Location:index.php');
}
?>

Answer 5

if ( $_POST['password'] AND $_POST['password'] == "Password")
{
header('Location:home.php');
} else
{
header('Location:wrong.php');
exit;
}