Login Form for mobile application using Jquery Mobile, PHP and MySQL -

i new mobile development. trying develop login form check username , password mysql database. built code already. have 2 problems. first 1 is, after submitted form, in browser's url bar, can see username , password typed, using post on jquery script. second issue page keeps going login.html instead going main.html. below built, using actual experience php, jquery , mysql.

html form

<div id="loginpage" data-role="page"> <div data-role="header"> <h1>app authentication</h1> </div>  <div data-role="content">        <div id="landmark-1" data-landmark-id="1">     <form id="loginform">     <div data-role="fieldcontain" class="ui-hide-label">         <label for="username">username:</label>         <input type="text" name="username" id="username" value="" placeholder="username" />     </div>      <div data-role="fieldcontain" class="ui-hide-label">         <label for="password">password:</label>         <input type="password" name="password" id="password" value="" placeholder="password" />     </div>      <input type="submit" value="login" id="submitbutton">     </form> </div>   </div>  <div data-role="footer">     <h4>&copy; silva's general services</h4> </div> 

the auth.php

<?php $mysqli = new mysqli($mysql_hostname,$mysql_user, $mysql_password, $mysql_database);  header("access-control-allow-origin: *"); header("access-control-allow-methods: get, post, options"); header("access-control-allow-credentials: true"); header("access-control-allow-headers: content-type, *"); header("content-type: application/json");  // parse log in form if user has filled out , pressed "log in" if (isset($_post["username"]) && isset($_post["password"])) {        crypt_blowfish or die ('no blowfish found.');        //this string tells crypt use blowfish 5 rounds.       $blowfish_pre = '$2a$05$';       $blowfish_end = '$';        $username = mysql_real_escape_string($_post['username']);       $password = mysql_real_escape_string($_post['password']);         $sql = "select id, password, salt, username users username='$username' limit 1";       $result = $mysqli->query($sql) or die( $mysqli->error() );       $row = mysqli_fetch_assoc($result);        $hashed_pass = crypt($password, $blowfish_pre . $row['salt'] . $blowfish_end);        if ($hashed_pass == $row['password']) {           $response_array['status'] = 'success';        } else {           $response_array['status'] = 'error';        } echo json_encode($response_array);  } $mysqli->close(); ?> 

jquery script

<script> $('#loginform').submit(function(){  e.preventdefault();  jquery.support.cors = true;   $.ajax({       url: 'http://www.test.com/mobile/auth.php',      crossdomain: true,      type: 'post',      data: $("#loginform").serialize(),       success: function(data){          if(data.status == 'success'){              window.location.href = 'http://www.test.com/mobile/main.html';           }else if(data.status == 'error'){              alert("authentication invalid. please try again!");              return false;                 }       }  });    });  </script> 

i appreciate help.

thank you.

this guess, but:

1. you have no method in form declaration: <form action="your_action_url" method="post">.

2. it looks not passing event in function. know syntax looking this: $('#loginform').submit(function(e){ notice "e" function parameter

3. jquery has e.preventdefault , e.stoppropagation 2 separate things, see jquery event object. other handlers may doing stuff. can use "return false;" instead of two, depending on use case.

i think 2. fix problem, need pass event function.