0

I've been running an PHP web app in my webserver (hostgator) for quite a while now, around like 8 months. With same code without any changes. And suddenly around 15-20 days back i noticed the web server is giving the following warning and is causing login failure partially and messing up the site real bad.

" Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/username/public_html/website.com/reports/dashboard.php:2) in /home/username/public_html/website.com/reports/include/connect.php on line 2 "

This used to work just fine. I've had not made any changes in several months now. And suddenly out of nowhere this warning messes up the website.

I would like to know if there's any setting on the web server that's maybe causing this? Because on my local machine is working just fine with this code, no errors, no warning. I would paste the code if necessary. Can you help out with this? Am I missing something? Some of the code sample is as follows.

connect.php

<?php

// MySQL connection file along with necessary functions for DB access.
error_reporting(E_ALL);
ini_set('display_errors', 1);
session_start();



$username = '*';
$password = '*';

$database = 'expenses';
$host = 'localhost';




$conn = mysqli_connect($host,$username,$password,$database) or die("Error: Could not access DB.");

require 'constants.php';
require 'functions.php';

?>

functions.php

<?php

function checkLogin($DASHBOARD){
    if(isset($_SESSION['USERNAME']) && $_SESSION['USERNAME']!=""){
        # User login is set up
        header("Location:".$DASHBOARD);
    }
}
?>

index.php

<?php
    $pageTitle = "Login";
    include_once 'include/header.php';
    include_once 'include/connect.php';
    checkLogin($DASHBOARD);

    // Lookup login validation and sign user in
    if(isset($_POST['login'])){
        $uname = $_POST['username'];
        $pass = $_POST['password'];

        if($uname != "" && $pass != ""){
            $query = "select id,username,role,password,firm from users where username = ?";

            if($stmt = mysqli_prepare($conn,$query)){
                mysqli_stmt_bind_param($stmt,"s",$uname);
                mysqli_stmt_execute($stmt);
                mysqli_stmt_bind_result($stmt, $id,$username,$role,$password,$firm_id);
                if(mysqli_stmt_fetch($stmt)){
                    if($password == md5($pass)){
                        $_SESSION['USERNAME'] = $username;
                        $_SESSION['ROLE'] = $role;
                        $_SESSION['USER_ID'] = $id;
                        $_SESSION['FIRM-ID'] = $firm_id;

                        if(in_array($id, $REST_ACCESS)){
                            header("Location:{$DASHBOARD}");
                        }
                        else if(in_array($id, $LODGE_ACCESS)){
                            header("Location:{$DASHBOARD}");
                        }
                        else{
                            header("Location:{$DASHBOARD}");
                        }

                    }
                    else{
                        setMsg("login-msg","Wrong Password, try again","warning");
                    }
                }   
                else{
                    setMsg("login-msg","incorrect username, try again ","warning");
                }
                mysqli_stmt_close($stmt);
            }
            else{
                setMsg("login-msg","Error fetching data !","danger");
            }
        }
        else{
            setMsg("login-msg","Please enter username and password ","info");
        }
    }
?>
FreeKrishna
  • 1,833
  • 2
  • 12
  • 21
  • *on line 2* in dashboard.php, you have whitespace before `\n – Lawrence Cherone May 29 '20 at 17:36
  • @LawrenceCherone I had a next line character which I removed and it didn't help. Besides shouldn't i face same issue in local server as well? – FreeKrishna May 29 '20 at 17:55
  • **Never store passwords in clear text or using MD5/SHA1!** Only store password hashes created using PHP's [`password_hash()`](https://php.net/manual/en/function.password-hash.php), which you can then verify using [`password_verify()`](https://php.net/manual/en/function.password-verify.php). Take a look at this post: [How to use password_hash](https://stackoverflow.com/q/30279321/1839439) and learn more about [bcrypt & password hashing in PHP](https://stackoverflow.com/a/6337021/1839439) – Dharman May 29 '20 at 21:07

0 Answers0