question about session variables

sudhakararaog

i have a registration page called register.php if the data entered is validated correctly i call a file called thankyou.php or else validate.php

presently a user after seeing the url website.com/thankyou.php if they enter the url directly in the browser as website.com/thankyou.php they can access the file, if a user accesses the file this way i would like to redirect to a page saying "Direct acess to this file is not allowed"

previously i used sessions in register.php and also in thakyou.php and validate.php and it worked fine for some reason now it is not working the way it is supposed to i might have made some changes which i do not know

previously my code in register.php was, the first few lines of register.php file

<?php
ob_start();
session_start();
if(!session_is_registered("directaccess"))
{
session_register("directaccess");
}
// rest of the html and php code
ob_end_flush();

?>

code in thankyou.php, the first few lines of register.php file

<?php
session_start();
if(!session_is_registered("directaccess"))
{
header("Location: http://website.com/directaccess.html");
exit;
}
// rest of the html and php code
ob_end_flush();

?>

NOTE = in thankyou.php i display a thank you message by retrieving the first name from register page and displaying in thankyou.php using session variables in the following way

in register.php, the first few lines of register.php file

if(!session_is_registered("firstname"))
{
session_register("firstname ");
}

$_SESSION[firstname] = $ firstname;

in thankyou.php, the first few lines of register.php file

if(session_is_registered("firstname "))
{
echo $_SESSION[firstname];
session_unregister("firstname ");

}

please advice how i should rewrite the php code in both the files(register.php and thankyou.php) so that if a user enters the url directly in the browser i can redirect to directaccess.html file

thanks.

rsmith

I do this by checking for the presence of a scenario. On the page I want protected I put this at the beginning:

     if(LOGGED_IN == 0){
		header("Location: login.php"); //If the session is invalid, redirect them here
	}else{
		header("Location: thankyou.php"); //If the session is valid this would be your thankyou.php file
	}

Then to define LOGGED_IN I check for the presence of a session that gets created on verify-login.php This script takes the username and password supplied on login.php and if valid sets, the required session variables for use later, and defines LOGGED_IN = 1, otherwise, tells them something is wrong:

if($_SESSION['username'] && $_SESSION['password']){
			define("LOGGED_IN", 1);
		}

Hope this helps. You should be able to adapt this to what you want to do.