LOGin is sending error - need help

[toplisek]

I receive message when validation is O.K. and Username and password not valid.
Error is the following:
Warning: Cannot modify header information - headers already sent by (output started at index.php) in login...
This is when ELSE is performed: header("Location: home.php");
Do you have suggestions? It recognised my name even I did not put any
data into login FORM.

I have the following script:

<?


/* Connect to MySQL-Server */
...

/* Open $db */
...

$user = $_POST['username'];
$pswr = $_POST['password'];


   $query ="SELECT * FROM users WHERE
                    username = '$user'
                    AND " ."
                    password = '$pswr'";


$result = mysql_query($query) or die("ERROR: " . mysql_error());
if(mysql_num_rows($result) > 0)  # we found a match, so set $_SESSION flag:
  {
    $_SESSION['logged'] = TRUE;
     if(isset($_SESSION['caller']))
        # if we got here from another page, go there
         {

      header("Location: " . $_SESSION['caller']);$loginvalid=1;

        }
      else
     # otherwise go to main page
        {
         header("Location: home.php");
        }
  }
  else
  # invalid login, so create error message
     {
    if ($validation=='true'&& (mysql_num_rows($result)==0))
      {$errorinput="This <b>Username or Password</b> is not valid!<br />"; }
     else  {$errorinput==""; }
     }
?>

[d4p41n]

make sure that there is no output before those lines (header(...))...
those lines have to be the first one on php sites before anything is outputed.

the other way is to set the outputbuffer (i dont know the exacly variable name) in the php.ini. Now php will buffer the whole side before sending it to the client.

best regards,
d4p41n

[toplisek]

Hi,
it has line and output: header("Location: " . $_SESSION['caller']);$loginvalid=1;
So, it remembered my username even I did not logIn in form in index.php.
than this message is shown. But when I logIN there is this problem. what can I change I code, please suggest. thanks

On each page there is code like:

 session_start();
                if(!isset($_SESSION['logged']) or $_SESSION['logged'] != TRUE)
                 {
                   $_SESSION['caller'] = $_SERVER['PHP_SELF'];
                  header('Location: index.php');
                 } 

[toplisek]

make sure that there is no output before those lines (header(...))...
those lines have to be the first one on php sites before anything is outputed.

the other way is to set the outputbuffer (i dont know the exacly variable name) in the php.ini. Now php will buffer the whole side before sending it to the client.

best regards,
d4p41n

Thanks d4p41n, I have read it again and it is correct. Those lines have to be the first one on php sites before anything is outputed.