PHP validation form

To display a simple error message you simply echo it above the form. See if this works

<?php

session_start();

$username = $_POST['username'];
$password = $_POST['password'];
$errors   = array();
$msg      = ""; //define an error msg variable


if (isset($_POST['username'], $_POST['password'])) {

    $connect = mysql_connect("localhost", "root", "") or die("Could not connect");
    mysql_select_db("login") or die("Could not find database");

    $query = mysql_query("SELECT * FROM users WHERE username ='$username'");

    $numrows = mysql_num_rows($query);
    if ($numrows != 0) {
        while ($row = mysql_fetch_assoc($query)) {
            $dbusername = $row['username'];
            $dbpassword = $row['password'];
        }

        if ($username == $dbusername && $password == $dbpassword) {
            echo header('Location: member.php');
            $_SESSION['username'] = $dbusername;
            $_SESSION['userid']   = $userid;
        } else
            $msg = "Incorrect password";
    } else
        $msg = "That user dosen't exist";

}

else
    $msg = "Please enter a username and a password";

?>


<div class='errorMsg'><?php echo $msg; ?></div>
  <form action="login.php" method="post"></form>
  <table border='0'>
    <tr>
      <td>Username:</td>
      <td><input name="username" required="" type="text"></td>
    </tr>

    <tr>
      <td>Password:</td>
      <td><input name="password" required="" type="password"></td>
    </tr>
    <tr>
      <td></td>
    </tr>
    <tr>
      <td><input id="myBtn" type="submit" value="Log in"></td>
      <td></td>
    </tr>
    <tr>
      <td>
        <a href='register.php'>Register</a>
      </td>
    </tr>
  </table>
  </form>

what about if you do this

<?php
$connect = mysql_connect("localhost","root","") or die ("Could not connect");
mysql_select_db ("login") or die ("Could not find database");

session_start();
function output_errors($errors){
return '<ul class="a"><li><strong>'.implode('</li><li>', $errors) .'</strong></li></ul>';
}

$errors = array();

if(empty($_POST) === false) {
$required_fields = array('username', 'password');
foreach ($_POST as $key=>$value) {
if(empty($value) && in_array($key, $required_fields) === true){
$errors[] = 'user name and password is empty !';
break 1;
}
}
$username = $_POST['username'];
$password = $_POST['password'];
if(strlen($_POST['password']) < 5){
$errors[] = 'Your password must be at least 5 Characters.';
}
if ($username&&$password)
{

$query = mysql_query("SELECT * FROM users WHERE username ='$username'");

$numrows = mysql_num_rows($query);
if ($numrows !=0)
{
    while ($row =mysql_fetch_assoc($query))
    {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];
    }

    if ($dbusername&&$password != $dbpassword) {
     $errors[] = "password wrong";  
    }
}
}
}
if(empty($_POST) === false && empty($errors) === true && $username==$dbusername&&$password==$dbpassword){
echo header( 'Location: member.php' ) ;
$_SESSION['username']=$dbusername;
exit();
}else if(empty($errors) === false){
echo output_errors($errors);
}
?>

              <table border ='0'>
                        <form action="login.php"  method="POST">
                            <tr><td>Username:</td> <td><input type="text" name="username" ></td></tr>
                            <tr><td>Password:</td> <td><input type="password" name="password" ></td><tr>
                            <tr><td><input button id="myBtn" type="submit" value="Log in"><td></tr>
                            <tr><td><a href='register.php'>Register</a></td></tr>
                    </table> 

Write a new PHP program, perhaps called checker.php. It is the job of checker.php to check for errors and present a "success" page if none are found. However, if checker.php finds an error, it sets a PHP variable, $error = TRUE; (You could use an array of you want to be able to report more than one error type; just have each element of the array be a code/abbreviation for the error type.) If there is an error, checker.php issues include 'login.php' which will redisplay your login page.

Here's the trick: have login.php check for $error like this: if isset($error) { ... and if so, use PHP's echo to display your error messages. You can carry forward things like the user ID and password in a $error array if you like. (But heed the cautions about security in the comments.)

If $error is not set, your login page is being displayed for the first time. Display it without error messages.

Here is a sort-of minimalist login.php:

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title>Login Form</title>
<style type="text/css">
p.error {color: red;}
</style>
</head>
<body>
<?php
   if (isset($error)) {  // same message for user ID or password for security
      echo '<p class="error">Error in user ID or password; please re-enter.</p>';
   }
?>
<form method="post" action="checker.php">
<label>User ID: <input type="text" name="userid" /></label><br />
<label>Password: <input type="text" name="password" /></label><br />
User ID: <input type="submit" value="Login" /><br />
</form>
</body>
</html>

And here is checker.php:

<?php
    $userid=(isset($_POST['userid']) ? $_POST['userid'] : FALSE);
    $password=(isset($_POST['password']) ? $_POST['password'] : FALSE);
    if ($userid !== 'jsnow') $error[] = 'userid';
    if ($password !== 'Ygritte') $error[] = 'password';
    if (isset($error)) {
        include 'login.php';
        exit;
    }
?>
<!DOCTYPE html>
<html>
<head>
<title>Login Success</title>
</head>
<body>
<h1>Success!</h1>
<p>You're logged in.  What do you want to do?</p>
</body>
</html>

It is possible to include the code from checker.php` in the login.php page, but it's easier to see what's going on if you write two separate pages. Try that before you try combining them.