page redirect from within if statement?

emeraldcat

Hi!

I'm still a bit new to all of this, so I will ask my question in this forum. :queasy:

I would like to have users login, and based on this login, if they're one type of customer I want to take them to pagex.php, if they're another, I want to take them to pagey.php.

Since I don't know what type of customer they are until they've logged in, I can't redirect with the header function, so I thought maybe I could do it by grabbing their login info, and seeing if they're type x, then go to pagex.php if they're type y, go to pagey.php:

function check_class() {
$user = $db->get_row("SELECT class FROM customers WHERE username={$_POST['username']} and {$_POST['password']}");

if ($user == 0) {
	send to xxx page
	} elseif ($user == 1) {
	send to xxx
	} else {
	echo "You are not yet registered.";
	}

}

Is there a more practical way to do this? Am I perhaps trying to reinvent the wheel here?

Thanks in advance for any help!

eCat

coreyp_1

This will work fine, just output the appropriate header.

emeraldcat

That was too easy. Thanks!! 😃

emeraldcat

Sigh... It was too easy! :bemused:

You see, since this is the login page, the form prints first (which sends the html tags to the server before anything else). Only after the script checks to see if the form has been filled out, does it run the if statement.

And so I get this error:

Warning: Cannot modify header information - headers already sent

So here is my code again - is there a way to do this without using the Location: function?

<?php

if ($_POST['submit_check']) {
	check_class();	

}else{

//jump out to print HTML form

?>

<html><body>
yada yada.. more HTML which prints the form  - has a hidden field called 'submit check' for the function to see if the form has been submitted yet

<?php

//back to PHP - end of else statement
}

function check_class() {
global $db;
$class = $db->getRow("SELECT class FROM customers WHERE username={$_POST['username']} and password={$_POST['password']}");

$class=$class->class;

if ($class == 0) {
	header ("Location: class0home.php");
	} elseif ($class == 1) {
	header ("Location: class1home.php");
	} else {
	echo "You are not yet registered.";
	}

}
?>

slweb

i would do this

<?php ob_start(); // make sure that this ob_start(); is at the very top of your page with the header(location) in it, with no spaces before the <?php 

if($_POST['submit_check']){ 

check_class();

}else{ 

//jump out to print HTML form 

?> 

<html><body> 
yada yada.. more HTML which prints the form- has a hidden field called 'submit check' for the function to see if the form has been submitted yet 

<?php 

//back to PHP - end of else statement 
} 

functioncheck_class(){ 
global $db; 
$class=$db->getRow("SELECT class,username,password FROM customers WHERE username={$_POST['username']} AND password={$_POST['password']} "); 

 header("Location: class .{$class}. home.php");

}

Brit

Hi,

Personally I think you need to re-evaluate your authentication process; simply redirecting based on the value of $class is really not secure and will lead to inevitable duplication of work later.

Anyhow, here's an example of how to rewrite your script slightly to be a bit more secure, and informative for users who fail to authenticate:

<?PHP

# Basic user authentication and redirect.
# 21.11.2005
# Author - Brit 
# PHPBuilder thread ID - 10312632
# REQUIREMENTS: MySQL connection and appropriate table.

function checkUserLogin()
{
	/* Make the username and password 'safe' - add to as needed. */
	$username = trim(strip_tags($_POST["username"]));
	$password = trim(strip_tags($_POST["password"]));

/* If we have both username and password, do the DB query */
if($username && $password)
{
	global $db; 

	/* NOTE! - You really should store your user's passwords in encrypted format and not plain text
	/* This is best practice and a doddle by adding PASSWORD('<user_password>') to your query. */

	$class = $db->getRow(sprintf("SELECT class FROM customers WHERE username='%s' and password=PASSWORD('%s')",
				$username,
				$password
				)); 

	/* Redirect based on value of $class.
	/* NOTE! if the value of $class = 0 (zero) we know they failed authentication and so your
	/* "class0home.php" page should be your "access denied" page. */

	header(sprintf("Location:class%dhome.php",$class));
	exit;
}
/* Something went wrong */
else
{
	$error = "Sorry, error!";
}

}

/* If the user submits the form, run the auth function above */
if($_POST["submit_check"])
{
	checkUserLogin();
}

?>
<html>
	<head>
	<title>Your form</title>
	</head>

<body>

<!-- The PHP below will echo out $error if the user fails authentication -->
<?PHP if($error) { echo sprintf(%s<br>\n",$error); } ?>

<!-- Your form goes here -->

</body>
</html>

Regards,

Brit

emeraldcat

Thank you, slweb and Brit.

Yes, this code was just my working code focused on finding the best way to redirect users based on their class. I was certainly going to encript the passwords after I figured this part out.

So maybe I've created too much work for myself...?

How SHOULD I redirect users based on certain criteria?

For instance - I have employers and employees. I'd like them to be able to log in from the same little login form. However, I want to direct them to different homepages based on whether they're an employer or employee (ie, their "class").

Is there a better way to do this? 😕

Thanks again!