title: Wrong login opens a session too
body: <p>I have written this login php based in sqlite:</p>
  
  <pre><code>&lt;?php
  $db = new PDO('sqlite:data.db');
  
  session_start();
  if (isset($_SESSION['timeout'])) {
      if ($_SESSION['timeout'] + 4 &lt; time()) {
          session_destroy();
      }
  } else {
      $_SESSION['pass']    = "";
      $_SESSION['timeout'] = time();
  }
  if (isset($_POST['pass'])) {
      $_SESSION['pass'] = $_POST['pass'];
  }
  
  if (!empty($_SESSION['pass'])) {
  
      $result = $db-&gt;query("SELECT password,user FROM users");
      foreach ($result as $row) {
          if (password_verify($_SESSION['pass'], $row['password'])) {
              echo "Welcome! You're logged in " . $row['user'] . "!  &lt;a href='index.php?logout=true'&gt;logout&lt;/a&gt;";
              if (isset($_GET['logout'])) {
                  unset($_SESSION['pass']);
                  header('location: index.php');
              }
          }
      }
  
  }
  
  else {
      echo '&lt;form method="POST" action=""&gt;&lt;input type="password" name="pass"&gt;&lt;form&gt;';
  }
  ?&gt;
  </code></pre>
  
  <p>This is my sqlite (data.db):</p>
  
  <p><a href="https://i.stack.imgur.com/gdwld.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gdwld.jpg" alt="enter image description here"></a></p>
  
  <p>MY PROBLEM IS THE FOLLOWING: If I login with one of the users in the database, the session is supossed to last 4 seconds, and you can read the message: Hello user, you're logged in (logout).</p>
  
  <p>BUT: If I introduce a mistaken password (which is not in the database), the screen turns white and I have to wait for 4 seconds too.</p>
  
  <p>MY QUESTION IS: How can I redirect wrong logins to the login form with no need to wait for the session to finish?</p>