hiding target path

[chayanvinayak]

i have used following script . In this script when the userid and password is correct , it redirects the user to gallery.html but i want to hide this link so that no one can go directly to gallery.html without authentication

by just typing :http://www.xxx.com/gallery.html

<?php

mysql_connect("localhost", "game_cvg", "cvg");
mysql_select_db("game_accounts");
session_start();
$userid = $GET['userid'];
$password = $GET['password'];
$status = 0;

$result = mysql_query("
SELECT credits FROM accounts
where userid = '$userid' and password = '$password' LIMIT 1");

if ($result && @mysql_num_rows($result)) {
// $status = 1;
header("Location:gallery.html");
}
else{
$status = 0;
}

echo $status;

?>

[Jasp182]

when you have validated the user, set a session variable and redirect to gallery.html
check for the session variable on gallery.html and redirect the user elsewhere if they don't have the required variable.
whenever you want to invalidate the current user, just unset the session variable

[Rodney_H_]

continuing on what Jasp182 said...

... therefore, your "gallery.html" file should probably be a PHP file, or "gallery.php" so you can use PHP to check for the presence of the set session variables. and redirect back to the login page if they are not set...