title: Login form is permitting access with blank user name and password
body: <p>I'm trying to implement a PHP login script which works with 3 PHP files. The scripts work fine when using correct user names and passwords, and the script even blocks access when the wrong information is provided. My problem is that the script is allowing access when you press the submit button on the form and don't insert a user name or password. </p>
  
  <p>The first script goes like this:</p>
  
  <pre><code>&lt;form action="login2.php" method="post"&gt;
  Usuario:&lt;br /&gt;
  &lt;input type="text" name="username" class="formtext" /&gt;
  Contraseña:&lt;br /&gt;
  &lt;input type="password" name="password" class="formtext" /&gt;
  &lt;input type="submit" value="Ingresar" class="formbutton" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>As you can see, the form accesses "login2.php" which goes like this:</p>
  
  <pre><code>&lt;?php
  $usernames = array("user1", "user2", "user3", "superman");
  $passwords = array("test", "pass2", "password3", "supermans password");
  $page = "noticias.php";
  
  for($i=0;$i&lt;count($usernames);$i++){
    $logindata[$usernames[$i]]=$passwords[$i];
  }
  if($logindata[$_POST["username"]]==$_POST["password"]){
  session_start();
  $_SESSION["username"]=$_POST["username"];
  header('Location: '.$page);
  exit;
  }else{
  header('Location: login.php?wrong=1');
  exit;
  }
  ?&gt; 
  </code></pre>
  
  <p>Finally, the page I'm trying to restrict access to has the following code added at the top to make sure the user is logged in:</p>
  
  <pre><code>&lt;?php require("login3.php"); ?&gt; 
  </code></pre>
  
  <p>And "login3.php" has the following code:</p>
  
  <pre><code>&lt;?php
  session_start();
  if(!isset($_SESSION['username'])){
  header('Location: login.php');
  exit;
  }
  ?&gt; 
  </code></pre>
  
  <p>If anyone can help me out with this since I got these scripts from an online tutorial, and don't know much about PHP, and really need to know why access is being allowed with blank usernames and passwords.</p>