title: PHP Login System Doesnt Always Work First Time - No Error Message, Loops Back To Login Page
body: <p>The problem I am facing is that when I attempt to login to my PHP website, the login form often does not take the user to the members page after login.
  Login does not work first time.
  Then, after using the same login credentials again, it works. It does not always happen. Sometimes it works first time no problems, other times, you have to login a second time for it to work.</p>
  
  <pre><code>&lt;?php
  session_start();
  require "connection.php";
  include "navigation.php";
  if(isset($_SESSION['origURL'])){
      $url = $_SESSION['origURL'];
  }
  $max_time = (time() - 60*60);
  $client = $_SERVER['REMOTE_ADDR'];
  $check = mysqli_query($conn,"SELECT * FROM login_attempts WHERE ip_address = '$client' AND time &gt;='$max_time'");
  $checkrow = mysqli_fetch_array($check);
  $tries = mysqli_num_rows($check);
  if($tries == 3){
      header("Location: robot.php");
      exit;
  }
  if ( isset($_COOKIE['userid']) &amp;&amp; (isset($_COOKIE['username']) &amp;&amp; ($_COOKIE['userid'] !== ""))){
      header("Location: member.php");
      exit;
  }
  $error = false;
  if(isset($_GET['activated'])){
      $error_msg = "&lt;div style='border: 2px solid green;margin-bottom:5px; padding:7px;'&gt;Token authenticated successfully - your account is now activated.&lt;/div&gt;";
  }
  if(isset($_GET['updated'])){
      $error_msg = "&lt;div style='border: 2px solid orange;margin-bottom:5px; padding:7px;'&gt;Your details have been updated. Please login again for these changes to take effect.&lt;/div&gt;";
  }
  if(isset($_POST['submit'])){
      $var_password = trim($_POST['password']);
      $var_password = strip_tags($var_password);
      $var_password = htmlspecialchars($var_password);
      $var_username = trim($_POST['username']);
      $var_username = strip_tags($var_username);
      $var_username = htmlspecialchars($var_username);
      if (empty($var_username)){
          $error = true;
          $error = 1;
      }else{
          if (empty($var_password)){
              $error = true;
              $error = 1;
          }
      }
      if (!$error){
          $var_password = hash('sha256', $var_password);
          $query = mysqli_query($conn,"SELECT username, password, userid, acc_active FROM users WHERE username = '$var_username'");
          $row = mysqli_fetch_array($query);
          $count = mysqli_num_rows($query);
          $userid = $row['userid'];
          $stat = $row['acc_active'];
          if ($count == 1 &amp;&amp; $row['username']==$var_username &amp;&amp; $row['password']==$var_password) {
              if($stat == "active" || $stat == "inactive"){
                  $_COOKIE['username'] = $row['username'];
                  $_COOKIE['userid'] = $row['userid'];
                  $userid = $_COOKIE['userid'];
                  setcookie("username", $var_username,  time()+30*24*60*60);
                  setcookie("userid", $userid,  time()+30*24*60*60);
                  $stmt = $conn-&gt;prepare("DELETE FROM login_attempts WHERE ip_address=?");
                  $stmt-&gt;bind_param("s",$client);
                  $stmt-&gt;execute();
                  $stmt-&gt;close();
                  if(isset($url)){
                      header("Location: $url");
                  }else{
                      header("Location: member.php");
                  }
              }else{
                  if($stat == "disabled"){
                      $error_msg = "&lt;div style='border: 2px solid red;margin-bottom:5px; padding:7px;'&gt;Account does not exist, or it is banned/disabled.&lt;/div&gt;";
                  }
                  if($stat == "notverified"){
                      $error_msg = "&lt;div style='border: 2px solid red;margin-bottom:5px; padding:7px;'&gt;Account is inactive. Please check your inbox / spam for activation token.&lt;/div&gt;";
                  }
              }
          } else {
              $error = 1;
          }
      }else{
          $error = 1;
      }
      if($error == 1){
          $when = time();
          $stmt = $conn-&gt;prepare("INSERT INTO login_attempts(ip_address, username, time) VALUES(?,?,?)");
          $stmt-&gt;bind_param("sss", $client, $var_username, $when);
          $stmt-&gt;execute();
          $stmt-&gt;close();
          $tries = $tries + 1;
          $error_msg = "&lt;div style='border: 2px solid orange;margin-bottom:5px; padding:7px;'&gt;".$tries. " of 3 login attempts used.&lt;/div&gt;";
      }
  
  }
  ?&gt;
  &lt;html&gt;
  &lt;head&gt;
      &lt;title&gt;Login&lt;/title&gt;
      &lt;link rel="stylesheet" type="text/css" href="styles.css"&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div class="login-container"&gt;
      &lt;h2 class="login-header"&gt;Login&lt;/h2&gt;
      &lt;?php echo $error_msg; ?&gt;
      &lt;form method="post" action="" style="text-align:center"&gt;
          &lt;input type="text" placeholder="Username...(case sensitive)" name="username" /&gt;
          &lt;input type="password" placeholder="Password..." name="password" /&gt;
          &lt;input type="submit" name="submit" value="Login"/&gt;
          &lt;br /&gt;
          or...
          &lt;br /&gt;
          &lt;a href="/rail/reset-password" class="login-btn-alt"&gt;Reset Password&lt;/a&gt;
          &lt;br /&gt;
          &lt;a href="/rail/register" class="login-btn-alt"&gt;Register Here&lt;/a&gt;
      &lt;/form&gt;
  
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Any clarification as to why the login doesn't always work first time would be great.
  Just to confirm, it is not a failed login. A failed login with incorrect credentials would display a message counting up to 3. There is no error message or problems in the inspect console etc or apache2 error log.
  Thanks in advance.</p>