登录表单总是需要多次尝试

Question

I have a slight problem with my log in script in PHP. When a user logs in, it only works after the second try, there is no error but it just looks like the user entered the wrong password on the first attempt.

Sometimes when I've been testing the site, after i try log in in the first time it sends me back to the log in page. Then I manually enter the url of the home page it will let me go there sometimes. (There's some php at the top that checks if the user is logged in already so im guessing sometimes the log in script sets the SESSION to true)

Majority of the time it doesn't do that though. It will just redirect me back to the log in with out printing the error message. I believe the problem is at the top of the home page and not with the log in script because after removing the redirect if mysql doesn't return a row with a user/password match it will direct me to the log in page anyways.

Here is my login script

<?php
session_start();
// Include required MySQL configuration file and functions



// Check if user is already logged in
if (isset($_SESSION['logged_in'])) {
    // If user is already logged in, redirect to main page
    redirect('home.php');
}
else {
        // Make sure that the user submitted a username/password and username
        // only consists of alphanumeric Chars

        if ( (!isset($_POST['username'])) || (!isset($_POST['password'])) OR
             ( !ctype_alnum($_POST['username'])) ) {

                redirect('login.php');
            }

        // Connect to database

        $mysqli = @new mysqli(DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE);

        if (mysqli_connect_errno()) { printf ("Unable to connect to database %s",
                                        mysqli_connect_error());
                                        exit();
            }
        //Escape any unsafe characters before querying database
        $username = $mysqli->real_escape_string($_POST['username']);
        $password = $mysqli->real_escape_string($_POST['password']);

        // construct SQL statement for query & execute
        $sql = "SELECT * FROM peeps WHERE name = '" . $username . "'
                AND pword = SHA1('" . $password . "') ";

        $result = $mysqli->query($sql);

        // If one row is returned, username and password are valid.
        if ($result->num_rows == 1 ) {
            // Set the session variable for login status to true
            $_SESSION['logged_in'] = true;
            $_SESSION['name'] = $username;
            echo "successfull ";
            redirect('home.php');
        }
        else { 
                echo "didnt return row<hr>";
                 redirect back to login page.
                redirect('loginPage.php');
            }
    }
?>

And here is the code at the top of my home page..

<?php
// Start session
session_start();
// Include required functions file
require_once('functions.php');
// Check login status... if not logged in redirect to login screen
    if (check_login_status() == false) {
        redirect('loginPage.php');
    }
$username = $_SESSION['name'];

?>

Any help would be appreciated, if you want to a little more clarification on what I mean you can sign up for gateKeeper and see what I'm talking about.

Also this is my first question so any comments on how I asked it would be appreciated.

Thanks!

Answer 1

Try debugging it by replacing

 if (check_login_status() == false) {
        redirect('loginPage.php');
    }

with

 if (!isset($_SESSION['name'])) { #could be any session variables that you like..
    redirect('loginPage.php');
}

or do print_r($_SESSION) on top of your homepage.