'Back' Button limitations

php_dev

Hey,

My system relies on the use of session variables.  This reliance makes the use of the back button potentially risky in some areas of the system.  Does anyone know of a way to make PHP aware of Back button hits, or a way to block them from being executed on certain scripts (ie. the script is aware that the back button has been used and redirects to a safe page).

Any help would be appreciated as this is a hole in my scripts.

Thanks,
php_dev

dagon

http is statless, you have to assume any page can be hit with out reference to any other and code accordingly, you could just put checks in the appropriate page, if the session is there or not or a particular session var is set, do what ever is appropriate.

php_dev

Yeah the stateless environment is a challenge in this project. A simple variable switch isn't the best way as some files can be reached by several different points in the system, so setting the variable becomes tricky. It is too interconnected to use a variable.

Is there any HTML code that will tell the browser not to allow back button hits for a certain page? All too often I am on webpages that control the back button movement, the only difference is my system has more entry points.

Any help would be great!

Thanks,
php_dev

dagon

php_dev;10903618 wrote:
Is there any HTML code that will tell the browser not to allow back button hits for a certain page? All too often I am on webpages that control the back button movement, the only difference is my system has more entry points.

you can use js but its stupid to even start down that road: what about bookmarks and history, and browsing with js off? You have to deal with this server side.

I don't see why session vars wont work for you.

php_dev

JS was never in the picture for me. I agree--too risky and unreliable. Server side is always better, I just wasn't sure if HTML/CSS offered any solutions to the problem.

Session vars aren' reliable for a lot of reasons. The system is complex, and yet because of effiency I reuse code for several different areas. As an example, code that processes and displays an addition to the order, also handles the deletion, editing, and simple viewing (if not logged in) of products. Simply put, there are too many directions to protect against to properly set a variable. This is not a simple login script where only session variable is set, and never changes. That is why I believe that setting session vars can not be effective in all pages of my script. I wondered my alternatives, but (as I figured) it looks like I have no choice but to go the route of variable switches.