php redirection?

[influx]

Would it be unsafe to redirect a user to a new page upon clicking submit on a login page?

As of now, i have 'login.php' with a textfield for username and password, and I was wondering what the code what look like if I wanted to do something like this:

if (user and password are correct) { then redirect to "login_success.php";}

else {echo 'your login information is incorrect, please try again';}
?>

That is the rough idea...but if i do something like that, would it be more insecure, or would that be a better idea?

THANKS SO MUCH GUYS!

-influx!

[drawmack]

<?
header(Location: 'whatever.php');
?>

[swr]

As long as you store the login information in a session (or similar) and check that on pages that require authorization, it is safe.

If you're only redirecting, and not checking on the other pages that the user really is logged in, that's not safe because the user could just punch in the target URL directly without actually logging in.

[leatherback]

An easy (Manageable) way to do this:

Add a small include in the head of each protected file, which will check wether a person is logged in, based on some specific variable / coded string in the session. If the combinations there are correct: Proceed. Else always redirect to login.php.

J.

[edit]

// my check.php script:
<?php 
session_start(); 

$lastpage = array_reverse(explode("/", $_SERVER[REQUEST_URI] ) );
    $lastpage = $lastpage[0];
session_register(lastpage);  // use this to redirect the user to the requested page once logged in!

if (!) //add some test here
   { 
   $location = "userlogin.php";
   header("location: ".$location);  

   }  

else
   {
   require($_SERVER['DOCUMENT_ROOT']."/page.php");   

   }            

[/edit]
?>

[/edit]

[influx]

hi, thanks for all your help...but how come this doesnt work?:

<?php
if($logged_in == 0) {
   $location = "login_success.php"; 
   header("location: ".$location);   

   } ?>

I know for a fact on that that $logged_in does equal 0.

this if statement doesnt work either:

<?php
if($logged_in == 0) {
   header("Location:login_success.php");
   } ?>

What could possibly be wrong? Thanks a lot!

-INFLUX!

[leatherback]

Hi,

Do you get any errors?

J

[tomwerner]

if $logged_in is stored in a session then you should use

$_SESSION["logged_in"]

hth