hide content if login incorrect??

Anon

My script works.. but when it redirects a user when their login is older than 5 days, for a split second you can see the content of the resticted page before it sends to the login page. How do I prevent this?

I am using a file with the code below as an include file on anything that must be protected.

Thanks, Bill

<?php
$colname_checkuser = "1";
if (isset($HTTP_COOKIE_VARS['user'])) {
$colname_checkuser = (get_magic_quotes_gpc()) ? $HTTP_COOKIE_VARS['user'] : addslashes($HTTP_COOKIE_VARS['user']);
}
mysql_select_db($database_highstreetradio, $highstreetradio);
$query_checkuser = sprintf("SELECT username, sessiondate, permissions FROM user WHERE username = '%s'", $colname_checkuser);
$checkuser = mysql_query($query_checkuser, $highstreetradio) or die(mysql_error());
$row_checkuser = mysql_fetch_assoc($checkuser);
$totalRows_checkuser = mysql_num_rows($checkuser);
$username = $row_checkuser['username'];
$permissions = $row_checkuser['permissions'];
$sessiondate_ts = strtotime($sessiondate);
// get the current time
$timenow_ts = time();
// get the time from the database
$sessiondate_ts = strtotime($sessiondate);
// compare the two with 5 hours
$timenow_ts = time();
if($timenow_ts-$sessiondate_ts<=5*3600) {
print "<SCRIPT> document.location.href='login.php'; </SCRIPT>\n";
}
mysql_free_result($checkuser);
?>

Anon

That's because you're using JavaScript to redirect. You should be using PHP's header() function to redirect.

Diego

Anon

What I found on another site was to do and if statement with the else actually writing out a completely different html page with a link to the login page.

Thanks.

-bill

Anon

You could do that too.

Diego

turrets

you could change this if statement:

if($timenow_ts-$sessiondate_ts<=5*3600) {
print "<SCRIPT> document.location.href='login.php'; </SCRIPT>\n";
}

to:

if($timenow_ts-$sessiondate_ts<=5*3600) {
print "<SCRIPT> document.location.href='login.php'; </SCRIPT>\n";
mysql_free_result($checkuser);
exit();
}

what this will do is print the script part, release your db conn and then exit the script.

to be proper, however. You should use the following:

if($timenow_ts-$sessiondate_ts<=5*3600) {
header("Location: login.php");
mysql_free_result($checkuser);
exit();
}