title: Android: odd response, possible redirect from PHP login
body: <p>So this is a follow up to <a href="https://stackoverflow.com/questions/16628452/android-http-login-not-having-desired-effect#comment23911537_16628452">this post</a>. I've tested the code in that post on other websites and I get valid responses and successful log ins. However on this site I get back what looks like a redirect. Here is the php file I'm trying to access.</p>
  
  <pre><code>&lt;?php
  session_start();
  error_reporting(E_ALL^ E_NOTICE);
  //include the connection and variable defination page
  include("include/server.php");
  include("include/function.php");
  //checking the form has been submit by user or not
  if(isset($_POST['cmdSubmit']) and $_POST['cmdSubmit']="Login")
  {   
  //$refLink  = $_SERVER['HTTP_REFERER'];
  $refLink    = "index.php?err_msg=1";
  $user = addslashes($_POST['username']);
  $pass = addslashes($_POST['password']);
  $remember = $_POST['remember'];
  
  $strErrorMessage = "";
  if($user==""){
      $strErrorMessage = "User Name can not be blank";
  }
  if($pass==""){
      $strErrorMessage = "Password can not be blank";
  }
  if($user=="" and $pass==""){
      $strErrorMessage = "User Name and Password can not be blank";
  }
  
  if($strErrorMessage=="")
  {
  
      if(isset($_POST['remember'])){
          //removing all the cookie at set the user name password in cookies
          unset($_COOKIE[session_name()]);        
          setcookie("usernamex", $_POST['username'], time()+60*60*24*100);
          setcookie("userpassx", $_POST['password'], time()+60*60*24*100);
          setcookie("rememberx", $_POST['remember'], time()+60*60*24*100);
      }else{
          if(isset($_COOKIE['rememberx']) &amp;&amp; isset($_COOKIE['usernamex']) &amp;&amp; isset($_COOKIE['userpassx']))
          {
              unset($_COOKIE[session_name()]);        
              setcookie("usernamex", $_POST['username'], time());
              setcookie("userpassx", $_POST['password'], time());
              setcookie("rememberx", $_POST['remember'], time());
          }
      }
  
      $sqlLogin   = "select * from member_mast where username = '".$user."' and password = '".$pass."' and is_deleted_flg=0 and is_profile=0";        
      $queryLogin = mysql_query($sqlLogin) or die(mysql_error()." Please check the Query");
      $totLogin   = mysql_num_rows($queryLogin);      
  
      //here checking the user is authorized or not 
      if($totLogin&gt;0)
      {
          $rsLogin                = mysql_fetch_array($queryLogin);   
          $_SESSION['uid']        = trim($rsLogin['username']);
          $_SESSION['memberid']       = trim($rsLogin['user_id']);
          $_SESSION['userType'] = trim($rsLogin['member_role']);
  
          if(isset($_POST["page"]) and trim($_POST["page"])!="")
          {
              $pageName       = trim($_POST["page"]);
              $pagepassId     = trim($_POST["pageid"]);
              $redirect_url   = "http://www.fakesite.com/fspv2/welcome.php?page=".$pageName."&amp;pageid=".$pagepassId;
          }
          else
          {
              //$redirect_url = "http://www.fakesite.com/fspv2/welcome.php";
              //$redirect_url = "welcome.php";
              $redirect_url   = "welcome.php";
          }
  //header("Location: ".$redirect_url);
  ?&gt;
          &lt;script&gt;window.location.href="&lt;?php echo $redirect_url; ?&gt;";&lt;/script&gt;
        &lt;!--  &lt;meta http-equiv="refresh" content="0;url=&lt;?php echo $redirect_url; ?&gt;"&gt;    --&gt;
  &lt;?php
  }
  else
  {       
          $displayMessage = "Login failed. If you are authorized, try again";
          session_destroy();
          $state = "inv";
          $_SESSION['username'] = $_POST['username'];
          $_SESSION['password'] = $_POST['pass'];         
          $username = $_SESSION['username'];
          $password = $_SESSION['password'];  
      ?&gt;
          &lt;script&gt;window.location.href="&lt;?php echo $refLink; ?&gt;";&lt;/script&gt;
      &lt;?php       
      }
  }
  else
  {   
      $state = "inv";
      $_SESSION['username'] = $_POST['userid'];
      $_SESSION['password'] = $_POST['pass'];
      $username = $_SESSION['username'];
      $password = $_SESSION['password'];
      $displayMessage = $strErrorMessage;
  ?&gt;
      &lt;script&gt;window.location.href="&lt;?php echo $refLink; ?&gt;";&lt;/script&gt;
  &lt;?php       
  }  
  }
   //header("Location: ".$refLink);
  ?&gt;
  &lt;!--&lt;script&gt;window.location.href="&lt;?php echo $refLink; ?&gt;";&lt;/script&gt;--&gt; &lt;!-- &lt;meta http-equiv="refresh" content="0;url=&lt;?php echo $refLink; ?&gt;"&gt;  --&gt;
  </code></pre>
  
  <p>Now when I connect to this login.php it doesnt matter if the username/pw is valid or not. The only response I get is this</p>
  
  <pre><code>05-18 17:08:50.160: V/RESPONSE(30797):  &lt;!--&lt;script&gt;window.location.href="";&lt;/script&gt;--&gt;       &lt;!-- &lt;meta http-equiv="refresh" content="0;url="&gt;                --&gt;    
  </code></pre>
  
  <p>Which looks as though it's <code>javascript</code> attempting to redirect me because it's a mobile device. The only redirect I can find in there is to redirect the client to the "welcome.php" which would be if they successfully logged in. I've gone through the files on the site and there does not appear to be a mobile login.php (i may be wrong). It should be noted I did not design the site I'm trying to log into and the site is operational and users can log in from this <code>php</code> file from their browser. I also have access to all the files. <strong>*My question is why isn't this <code>php</code> file allowing me to login via my android app and instead giving me this odd response? *</strong> If you need to see any other code please just ask. Thanks!</p>