Wsrtjtyk

I'm using php but without database.

When I log in with the wrong username/password, it shows "Incorrect username/password" which is correct.

However, when I access the other webpages without logging in, it also shows "Incorrect username/password" instead of "You must be logged in to access this page".

<?php

$username = "admin";

$password = "its30305";



session_start();



if(isset($_SESSION['username])){

    echo "<h1>Welcome ".$_SESSION['username]."</h1>";

}



else{

    if($_POST['username] == $username && $_POST['password'] == $password){

         $_SESSION['username] = $username;

         echo "<script>location.href='mainmenu.php'</script>;

    }



    elif($_POST['username] != $username || $_POST['password'] != $password){

         echo "<script>alert('Username/Password incorrect!')</script>";

         echo "<script>location.href='login.php'</script>;

    }



    elif(!isset($_SESSION['access]){

         echo "<script>alert('You must log in to access this page')</script>";

         echo "<script>location.href='login.php'</script>;

    }

?>

You shouldn't validate login like that but if you want to know about the problem,
check this line:

else if(!isset($_SESSION['access']){

Check $_SESSION['access'] before $_POST and you shouldn't have that problem anymore:

if(!isset($_SESSION['access']){

     //Need login to access this page

}else if($_POST['username'] == $username && $_POST['password'] == $password){

     //Wrong username or password

}else if ...

I strongly recommend to change structure of your code:

Use PHP forwarding instead of JavaScript forwarding

If you want to forward to the login page when user doesn't have permission to the page, use header like this:

header('location: /login.php');

die();

Always terminate the current script after forward by using die() or exit().

Check if $_POST key is set before using it

make sure $_POST set before, For example:

isset($_POST['username']) && $_POST['username'] == $username

Don't store raw password in your codes

Always store hash password, no matter you are using database or not. If you want to find out what is your password hash you can find it out with:

password_hash("its30305", PASSWORD_DEFAULT);

and you can use it in your code:

$username = 'admin';

$password = '$2y$10$ZSCf.Nlma2mBrKetjqnEB.sdWcBiGJoByhPxwo9wCW8Nvz5Zc7Omm';  //Result of password_hash("its30305", PASSWORD_DEFAULT);

Read about password_hash

Use password_verify to verify your password

You can verify password with password_verify like this:

isset($_POST['password']) && password_verify($_POST['password'],$password)

Read about password_verify.

Show proper message in login page

If you want to show to the user, you need to login to see the page content, you can set a $_SESSION['login_message'] before header(), and check that session in login page. If it is set show proper message on login page and then unset the session. For example:

$_SESSION['login_message'] = 1; //user need to login to see the content

header('location: /login.php');

die();

on login.php:

if (isset($_SESSION['login_message'])){

   switch ($_SESSION['login_message']){

        case 1:

           echo 'Need to login to see the page.';

           break;

        case 2:

           echo 'Wrong username or password.';

           break;

   }

   //saw the message, not need it anymore!

   unset($_SESSION['login_message']);

}