php SQL authentication issue - php

Question

I have a user login page with a form that's action is "auth.php"
auth.php looks like this :
<?php
session_start();
require_once('database.php');
$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM access_getaccountswithinfo WHERE username='".$username."' AND password='".$password."'";
$run = mysql_query($sql);
$row = mysql_fetch_array($run);
if (mysql_num_rows($run) == 1) {
$_SESSION['logged_in'] = true;
$_SESSION['username'] = $row['username'];
$_SESSION['password'] = $row['password'];
$_SESSION['packagename'] = $row['packagename'];
$_SESSION['creation-date'] = $row['creation-date'];
$_SESSION['cap'] = $row['cap'];
$_SESSION['total'] = $row['total'];
$_SESSION['remainingtopup'] = $row['remainingtopup'];
header("location: usage.php");
} else {
header("location: user_login.php");
$message = MSG_INVALID_USERPW;
}
mysql_close($link);
?>
Then this auth.php has a Require_once to : database.php
database.php as follow :
<?php
$link = mysql_connect('localhost', 'testdatabase', '123456');
if (!$link) {
die('Could not connect: ' . mysql_error());
}
// make testdatabase the current db
$db_selected = mysql_select_db('testdatabase', $link);
if (!$db_selected) {
die ('Can\'t use foo : ' . mysql_error());
}
echo 'Connected successfully';
?>
So in short...you login on login page , action then checks with auth.php if user can authenticate whilst requiring database.php to connect , if user authenticates , it takes them to page usage.php as set by header("location: usage.php"); in auth.php.
NOW this works 100% on my local machine , with a xampp Apache and SQL server.
But when I uploaded this to the webserver, I login on login page and the it takes me to the page "auth.php" and stops there and shows "connected Successfully" as per echo in database.php. and nothing further , it is suppose to authenticate and then take me to usage.php. Ive checked database name , table ect , all correct , any ideas pleas?

Answer 1

You are not allowed to write anything to the output-stream before you use header(...). It might work on some servers but you should not expect it to.
Remove all the echo and print statements in your code and you should be redirected.
Additionally, you should really use mysql_real_escape_string(..) [http://php.net/manual/en/function.mysql-real-escape-string.php], or even change from the deprecated mysql_ commands to PDO. Right now I could login to your website by using the username ' OR 1=1 LIMIT 0,1; --

Answer 2

NOW this works 100% on my local machine
That's some really bad code. Bypassing the authentication is trivial.
You don't do any further error checking after establishing the connection.

Answer 3

Once you echo something, you can no longer set any headers. Try removing the echo statements.
Source: http://php.net/manual/en/function.header.php
Quote: "Remember that header() must be called before any actual output is sent, either by normal HTML tags, blank lines in a file, or from PHP. It is a very common error to read code with include, or require, functions, or another file access function, and have spaces or empty lines that are output before header() is called. The same problem exists when using a single PHP/HTML file."

Answer 4

try adding
error_reporting(E_ALL);
ini_set('display_errors', '1');
in the top of your code
and see if there are errors or not, usually errors are hidden in a hosting server

Answer 5

Just try to delete the echo 'connected successfully'; from the code and try to omit any blank line , because header function is too sensitive it needs that you have not send any output before using them so any echoing or any simple html is considered as output and the header function will not functions properly due the error that headr is already sent and if the level of error reporting is to hide error you will not notice this error
please try to omit any space or any echoing before the header function calling then tell me the result :)