 <p>OK, as you are dealing with authentication, let's improve your code a little.</p> <pre><code>&lt;?php // Do not connect using root, especially when not setting a password: $con=mysqli_connect("localhost","projectuser","password","project"); if(mysqli_connect_errno()) { echo "failed".mysqli_connect_errno(); } $uid = $_GET['username']; $pass = $_GET['password']; // This is the main problem, there was a typo: $sql = "SELECT * FROM login"; // Directly ask the DB if the credentials are correct. // Then you do not need the loop below. // BUT: Do not forget to escape the data in this case! $sql .= " WHERE uid = '" . mysqli_real_escape_string($uid) . "' AND pass = '" . mysqli_real_escape_string($pass) . "'"; $result=mysqli_query($con,$sql); if ($result-&gt;num_rows === 1) { header('location:http://localhost/mam.html'); } else { header('location:http://localhost/error/index.html'); } mysqli_close($con); ?&gt; </code></pre> <p>A further improvement would be to hash (and salt) the password in the database.</p> <p>Also, as VMai pointed out, the use of prepared statements would be appropriate.</p>