Another headers question - How to authenticate

[phpdeano]

Hi,

I currently have the following that works fine

<?php
include "./auth1.php";

$select = "SELECT * FROM table".$tableid;
$export = mysql_query($select);
$fields = mysql_num_fields($export);

for ($i = 0; $i < $fields; $i++) {
    $header .= mysql_field_name($export, $i) . "\t";
}

while($row = mysql_fetch_row($export)) {
    $line = '';
    foreach($row as $value) {
        if ((!isset($value)) OR ($value == "")) {
            $value = "\t";
        } else {
            $value = str_replace('"', '""', $value);
            $value = '"' . $value . '"' . "\t";
        }
        $line .= $value;
    }
    $data .= trim($line)."\n";
}
$data = str_replace("\r","",$data);

if ($data == "") {
    $data = "\n(0) Records Found!\n";
}
?>
<?php
header("Content-type:application/x-msdownload");
header("Content-Disposition:attachment;filename=test.xls");
header("Pragma:no-cache");
header("Expires:0");
print "$data";
?>

The problem is that I need to restrict the download ability to logged on users only.

The script I use to check the session is

<?php
session_start();
header("Cache-control: private"); //IE 6 Fix
if(!isset($HTTP_SESSION_VARS) || (isset($HTTP_SESSION_VARS) && !array_key_exists("auth_user",$HTTP_SESSION_VARS)))
{
print "<SCRIPT LANGUAGE='JavaScript' TYPE='text/javascript'>
window.location.href ='./login.php';
</SCRIPT>";
exit;
}
?>

I attempted to simply include the session check script at the top of my spreadsheet export script but it didn't work.

I know there must not be any whitespace before the headers are called but I cannot get these 2 scripts to work together. I know the problem is related to calling something before the headers are called but I cannot see where.

Please could someone advise how I do this.

[nemonoman]

header errors are a pain in the butt.
Here are some common problems:
All headers must execute BEFORE ANY OUTPUT is sent to the browser.

ERROR:
header("Expires:0");
print "$data";
header("Pragma:no-cache");

OK:
header("Expires:0");
header("Pragma:no-cache");
print "$data";

If your PHP files contain ANY CHARACTERS before the <?, THOSE COUNT AS OUTPUT

Example: Assuming the file below was named Bad.php, this file could generate an error

<!-- WHat's wrong with this file??--!>
<!-- answer - these HTML lines will be sent as browswer data immediately--!>
<?
header("Pragma:no-cache");

?>

Calling the above file will fail with a header error. It will also fail in the following:

If my php script said
<?
header("Expires:0");
include 'bad.php';
?>

the result would be a header error.

MAKE SURE that your script and the included files your script calls output NO data until all the headers are processed.

You an avoid these errors entirely using [man]ob_start[/man] which will handle header management for you.