CodeIgniter login session

Question

I'm new in CodeIgniter and I tried to create a login system on my website. When I try to enter on page Overview, it sends me on login page but after I put my correct email and password nothing happens.

Login.php - controller

    <?php if ( ! defined('BASEPATH')) exit('No direct script access
allowed');
     class Login extends CI_Controller {
      function __construct()
      {
        parent::__construct();
      }

      function index()
      {
        $this->load->helper(array('form'));
        $this->load->view('login');
      }

     }
    ?>

Overview.php - controller

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class Overview extends CI_Controller {

 function __construct()
 {
   parent::__construct();
 }

 function index()
 {
   if($this->session->userdata('logged_in'))
   {
     $session_data = $this->session->userdata('logged_in');
     $data['username'] = $session_data['username'];
     $this->load->view('overview', $data);
   }
   else
   {
     //If no session, redirect to login page
     redirect('login', 'refresh');
   }
 }

 function logout()
 {
   $this->session->unset_userdata('logged_in');
   session_destroy();
   redirect('home', 'refresh');
 }

}

?>

VerifyLogin.php - controller

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class VerifyLogin extends CI_Controller {

 function __construct()
 {
   parent::__construct();
   $this->load->model('user','',TRUE);
 }

 function index()
 {
   //This method will have the credentials validation
   $this->load->library('form_validation');

   $this->form_validation->set_rules('email', 'E-mail', 'trim|required|xss_clean');
   $this->form_validation->set_rules('password', 'Password', 'trim|required|xss_clean|callback_check_database');

   if($this->form_validation->run() == FALSE)
   {
     //Field validation failed.  User redirected to login page
     $this->load->view('login');
   }
   else
   {
     //Go to private area
     redirect('home', 'refresh');
   }

 }

 function check_database($password)
 {
   //Field validation succeeded.  Validate against database
   $username = $this->input->post('username');

   //query the database
   $result = $this->user->login($username, $password);

   if($result)
   {
     $sess_array = array();
     foreach($result as $row)
     {
       $sess_array = array(
         'id' => $row->id,
         'username' => $row->username
       );
       $this->session->set_userdata('logged_in', $sess_array);
     }
     return TRUE;
   }
   else
   {
     $this->form_validation->set_message('check_database', 'Invalid username or password');
     return false;
   }
 }
}
?>

Login.php - views

<div class="container">
<div class="row">
<div class="col-md-4 col-md-offset-4 well">
<form role="form" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="loginform">
<fieldset>
<legend>Login</legend>
<div class="form-group">
<label for="name">Email</label>
<input type="text" name="email" placeholder="Your Email" required class="form-control" />
</div>

<div class="form-group">
<label for="name">Password</label>
<input type="password" name="password" placeholder="Your Password" required class="form-control" />       
</div>

<div class="form-group">
<input type="submit" name="login" value="Login" class="btn btn-primary" />
</div>
</fieldset>
</form>
<span class="text-danger"><?php if (isset($errormsg)) { echo $errormsg; } ?></span>
</div>
</div>

Thanks and I hope somene will give me a solution.

Answer 1

When you enter login page, the action will be "Login.php" because of $_SERVER['PHP_SELF'].

<form role="form" action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="loginform"> 

The $_SERVER["PHP_SELF"] is a super global variable that returns the filename of the currently executing script.

You need to change the action to VerifyLogin, so when you submit form, the index() method in Verifylogin.php will execute.

<form role="form" action="VerifyLogin" method="post" name="loginform">

xss_clean is no longer a part of form validation so remove it. XSS cleaning should be used on output not input.

$this->form_validation->set_rules('email', 'E-mail', 'trim|required');
$this->form_validation->set_rules('password', 'Password', 'trim|required|callback_check_database');