title: Cannot modify header information - headers already in checkout.php on line 84
body: <p>I have spent days trying to fix this and cannot find any sort of output or white spaces before the two headers.<br>
  Any help would be greatly appreciated.<br>
  Thank you.  </p>
  
  <p>On <code>jcart.php</code> I cannot find any white spaces or output either.</p>
  
  <pre><code>&lt;?php
  include_once('jcart/jcart.php');
  // First we execute our common code to connection to the database and start the session 
  require("common.php"); 
  // This if statement checks to determine whether the login form has been submitted 
  // If it has, then the login code is run, otherwise the form is displayed 
  if(!empty($_POST['userform'])) 
  { 
      // This query retreives the user's information from the database using 
      // their email. 
      $query = " 
          SELECT 
              id, 
              email, 
              password, 
              salt 
          FROM customers 
          WHERE 
              email = :email 
      "; 
      // The parameter values 
      $query_params = array( 
          ':email' =&gt; $_POST['email'] 
      ); 
      try 
      { 
          // Execute the query against the database 
          $stmt = $db-&gt;prepare($query); 
          $result = $stmt-&gt;execute($query_params); 
      } 
      catch(PDOException $ex) 
      { 
          // Note: On a production website, you should not output $ex-&gt;getMessage(). 
          // It may provide an attacker with helpful information about your code.  
          die("An error has occurred. Please e-mail X to report the problem."); 
      } 
      // This variable tells us whether the user has successfully logged in or not. 
      // We initialize it to false, assuming they have not. 
      // If we determine that they have entered the right details, then we switch it to true. 
      $login_ok = false;  
      // Retrieve the user data from the database.  If $row is false, then the email 
      // they entered is not registered. 
      $row = $stmt-&gt;fetch(); 
      if($row) 
      { 
          // Using the password submitted by the user and the salt stored in the database, 
          // we now check to see whether the passwords match by hashing the submitted password 
          // and comparing it to the hashed version already stored in the database. 
          $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
          for($round = 0; $round &lt; 65536; $round++) 
          { 
              $check_password = hash('sha256', $check_password . $row['salt']); 
          } 
  
          if($check_password === $row['password']) 
          { 
              // If they do, then we flip this to true 
              $login_ok = true; 
          } 
      }  
      // If the user logged in successfully, then we send them to the private members-only page 
      // Otherwise, we display a login failed message and show the login form again 
      if($login_ok) 
      { 
          // Here I am preparing to store the $row array into the $_SESSION by 
          // removing the salt and password values from it.  Although $_SESSION is 
          // stored on the server-side, there is no reason to store sensitive values 
          // in it unless you have to.  Thus, it is best practice to remove these 
          // sensitive values first. 
          unset($row['salt']); 
          unset($row['password']); 
          // This stores the user's data into the session at the index 'user'. 
          // We will check this index on the private members-only page to determine whether 
          // or not the user is logged in.  We can also use it to retrieve 
          // the user's details. 
          $_SESSION['user'] = $row; 
          // Redirect the user to the private members-only page. 
          header("Location: checkout.php"); 
          die("Redirecting to: checkout.php"); 
      } 
      else 
      { 
          // Tell the user they failed 
          header("Location: checkout.php?msg=failedlogin");
          // Show them their email again so all they have to do is enter a new 
          // password.  The use of htmlentities prevents XSS attacks.  You should 
          // always use htmlentities on user submitted values before displaying them 
          // to any customers (including the user that submitted them).  For more information: 
          // http://en.wikipedia.org/wiki/XSS_attack 
      } 
  } 
  
  ?&gt; 
  &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"&gt;
  &lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
  </code></pre>