Why can I jump to the page if I enter the verification code incorrectly?

Question

<?php

session_start();

header('Content-type:text/html;charset=utf-8');

$code = $_POST["code"]; //Verification code

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

if (empty($_POST['username '])){

echo "<script>alert('Username cannot be empty!');location.href='login.html';</script>";

}else {

                                                                                                  using   using   using           using using ’s ’ ’s ’ using using  ‐  ‐  ‐  $username=$_POST['username'];

# echo "<script>alert('Password cannot be empty!');location.href='login.html';</script>";

}else{

$password=$_POST['password'];

}

}

if($code != $_SESSION['authcode']) //Determine whether the filled-in verification code matches the information generated by the verification code PHP file

{

echo "<script type='text/javascript' >alert('Verification code error!');location='login.html';</script>";

}

$ mysqli = new mysqli('localhost', 'root', 'root', 'user');

$result = $mysqli->query("SELECT password FROM user WHERE username = "."' $username'");

$rs=$result->fetch_row();

if (!empty($rs)){

if ($password != $rs[0]) {

echo "<script>alert('Wrong password! ');location.href='login.html';</script>";

}else{

$expire=3600;

ini_set('session .gc_maxlifetime', $expire);//Save for 1 hour

if (empty($_COOKIE['PHPSESSID'])) {

session_set_cookie_params($expire);

session_start();

}else{

session_start();

setcookie('PHPSESSID', session_id(), time() $expire);

}

iF (isset ($ _ session ['username'])) {

Header ("local: index.html");

##} else {

                                                                          use   with  $_SESSION['username']=$_POST['']; </script><br>";

echo "Hello! {$_SESSION['username']}, welcome back!";

echo "<a href='logout.php'>Logout</a>" ;

}

}else{

echo "<script>alert('No such user!');location.href='login.html';< ;/script>";

}

?>

Answer 1

echo "<script type='text/javascript'>alert('Verification code error!');location='login.html';</script>";

added after return

Answer 2

Don’t use so many ifs when writing code without truncation