error message not showing on password fail - php

Question

why is my error message not showing if password or username is incorrect? i would like an error message displayed if the user enters the wrong username or password
code can be seen below
<?php
// Inialize session
session_start();
// Include database connection settings
include('connect.inc');
// Retrieve username and password from database according to user's input
$login = mysql_query("SELECT * FROM users WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . mysql_real_escape_string(md5($_POST['password'])) . "')");
// Check username and password match
if (mysql_num_rows($login) == 1) {
// Set username session variable
$_SESSION['username'] = $_POST['username'];
}
else
{
// Invalid login
echo "Your username or password are incorrect!";
}
// Jump to secured page
$row = mysql_fetch_array($login);
switch ($row['drop']):
case yes:
header('Location: choose1.php');
exit;
case no:
header('Location: choose2.php');
exit;
}
else {
header('Location: login.php');
}
?>

Answer 1

write case value in ' also break in switch case
case 'yes':
header('Location: choose1.php');
exit; // this line shouldn't be needed but it's good practice
break;
case 'no':
header('Location: choose2.php');
exit;
break;
better way:
<?php session_start();
require_once('connect.inc');
// Retrieve username and password from database according to user's input
$input_username = mysql_real_escape_string($_POST['username']);
$login = mysql_query("SELECT * FROM users WHERE username = '".$input_username."'" );
// Check username and password match
$row = mysql_fetch_array($login);
if (mysql_num_rows($login)) {
if($row['password'] === md5($_POST['password'])){
$_SESSION['username'] = $_POST['username']; // store in session
switch ($row['drop']){
case 'yes': header('Location: choose1.php'); break;
case 'no': header('Location: choose2.php'); break;
}
exit;
}
else {
echo "Wrong username and password combination";
exit;
}
}
else{
// Invalid login
echo "Invalid Unsername";
header('Location: login.php');
exit;
}
?>

Answer 2

<?php
// Inialize session
session_start();
// Include database connection settings
include('connect.inc');
// Retrieve username and password from database according to user's input
$login = mysql_query("SELECT * FROM users WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . mysql_real_escape_string(md5($_POST['password'])) . "')");
// Check username and password match
if (mysql_num_rows($login) == 1) {
// Set username session variable
$_SESSION['username'] = $_POST['username'];
}
else {
// Invalid login
header('Location: login.php?try=failed');
exit;
}
// Jump to secured page
$row = mysql_fetch_array($login);
switch ($row['drop']) {
case 'yes': header('Location: choose1.php'); exit;
case 'no': header('Location: choose2.php'); exit;
}
?>
On login.php, check for try=failed:
if ($_GET['try'] === 'failed') {
echo "Your username or password are incorrect!";
//echo YOUR_LOGIN_FORM here
}

Answer 3

Probably a better way to handle your problem.
Note: I initialize a $_SESSION['error'], just use an if(isset($_SESSION['error'])) echo $_SESSION['error']; on your login.php to display the error.
// Inialize session
session_start();
// Include database connection settings
include('connect.inc');
// Retrieve username and password from database according to user's input
$login = mysql_query("SELECT * FROM users WHERE (username = '" . mysql_real_escape_string($_POST['username']) . "') and (password = '" . md5($_POST['password']) . "')");
// Check username and password match
if(mysql_num_rows($login) == 1) {
// Set username session variable
$_SESSION['username'] = $_POST['username'];
// fetch results
$row = mysql_fetch_array($login);
// jump to secured page
switch($row['drop'])
{
case 'yes':
header('Location: choose1.php');
exit;
case 'no':
header('Location: choose2.php');
exit;
}
} else {
// invalid login
// set error session
$_SESSION['error'] = "Your username or password are incorrect!";
header('Location: login.php');
exit;
}
?>