php - How do I set whether a form redirects to a new page or not? -

so i'm trying create simple log in page php , html. it's pretty simple. first, user inputs username , password, clicks submit button.

if username/password combo invalid, "invalid log in." printed, , user redirected log in page.
if username/password combo valid, "logging in..." printed, , user redirected page. all post data must kept when redirecting.

i can't figure out how change form's action.

code snippet below. please past potential sql injections. deal them later.

<form action="<?php echo htmlspecialchars($_server['php_self']); ?>" method="post" id="form">  user name:<input type="text" name="username" id="username"> password:<input type="password" name="password" id="password"> <input type="submit" name="submit" id="submit" value="submit"> <input type="reset" name="reset" id="reset" value="reset">  <?php $username = $_post['username']; $password = $_post['password']; //(omitted) function checks whether credentials valid or not if (password_verify($password, $hash)) {     echo "logging in...";     //todo: function redirects user page } else {     echo "invalid log in."; } ?> 

you can header function , choose redirect. per other's suggestion, nothing should echoed before calling header. can check if current request post or get. post, can authentication, , get, output form. can use $_session variable check if redirected successful or failed login attempt.

<?php  session_start();  if (isset($_post['username'])) {     $username = $_post['username'];     $password = $_post['password'];      if (password_verify($password, $hash)) {         $_session['login_success'] = true;         header('location: user.php?login_success=1');         } else {         $_session['login_success'] = false;         header('location: index.php');     } }  if (isset($_session['login_success']) && !$_session['login_success']) {     echo "invalid log in.";     unset($_session['login_success']); } ?>  <form action="<?php echo htmlspecialchars($_server['php_self']); ?>" method="post" id="form">  user name:<input type="text" name="username" id="username"> password:<input type="password" name="password" id="password"> <input type="submit" name="submit" id="submit" value="submit"> <input type="reset" name="reset" id="reset" value="reset"> 

in user.php, can check $_session variable well.

<?php session_start(); if (isset($_session['login_success']) && $_session['login_success']) {     echo "successful login.";     unset($_session['login_success']) }