Member Avatar for aparnesh

How can I redirect a page to another ? For example, if the user is registered he gets to see the members section and if he is not, he is redirected to a 'Register Now' page when he clicks on a members area link.

Also how will it work if he types in the address in the address bar ? For example, he types . So when this page loads, it checks if the user is logged in. If he is not, it redirects him to a 'Guest' page or something.

The logging in checking can be done by setting a cookie, if I am not mistaken. How can I redirect to a different page or different site ?

I am a newbie at Php, so sorry if this is too trivial.

Regards

  • 4 Contributors
  • 5 Replies
  • 307 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Astegiano

Dani AI

Generated

Short answer: always enforce access on the server, not just in links. Whether someone clicks a link or types /members_area.php, the script must check authentication at the very start and deny or redirect if the user is not logged in. asked the right question — client-side tricks (meta/JS) can improve UX but are not a security measure. is also right to recommend sessions for real protection.

A simple, robust pattern is to centralize the check in one file and include it at the top of every protected page. Keep the check minimal, verify the session against your store if you need extra safety, remember where the user wanted to go, then either present the login form or send them to the login page and stop execution. Example (new pattern: include login instead of relying only on a redirect):

<?php
// require-auth.php  -- include at top of protected pages
if (session_status() !== PHP_SESSION_ACTIVE) session_start();

if (empty($_SESSION['user_id']) || !is_session_valid($_SESSION['user_id'])) {
    // remember requested URI so user can be returned after login
    $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
    // show login form (server-side) with a 401 status to avoid open-redirect problems
    http_response_code(401);
    include __DIR__ . '/login-form.php';
    exit;
}
?>

Practical tips and cautions: call this include before any output to avoid "headers already sent" errors; if output happens earlier, fix BOM/whitespace or enable output buffering. Regenerate session id on successful login to prevent fixation, set session cookie flags (Secure, HttpOnly, SameSite), and never accept an arbitrary URL parameter for redirect without validating it (open-redirect risk). Use a central include so every protected page uses the same logic; that keeps behavior consistent whether users click a link or type a URL.

For debugging: try accessing a protected page in a private browser window to confirm the check works, and log why access was denied (missing session, expired token, etc.). This keeps the flow simple, secure, and maintainable.

Recommended Answers

All 5 Replies

Member Avatar for shaocpa

IM interested in PHP.I can solve your question
I think this is a question about "SESSION"
please write out your code

Member Avatar for Puckdropper

No, it has nothing to do with session. It has everything to do with HTML headers. You can send a header such as refresh using:

header([i]header field[/i]

I haven't looked up the exact syntax (not on my computer with that info at my finger tips) of a redirect, but this'll give you a good place to start.

Member Avatar for shaocpa

redirect a page to another
I know three methods
1 : use header()
for example
<? header("location: $url"); ?>
2: use HTML <META>
for example
<meta http-equiv="refresh" content="5";url=<? echo $url; >>
3: use javascript
for example
<?
echo "<!--<script language='javascript'>";
echo "location.href='$url'";
echo "</script>-->";
?>
AT the same time ,I think it is better if you combine this means with SESSION!

Member Avatar for aparnesh

Thanks a lot.

Member Avatar for Astegiano

The best way to set authorization for each page is to use the sessions. The best way to do it is to set two sessions variable: one that contain the level of authorization (for the normal users 1, for moderators 2, the administrator 3) or if you dont want different level just a boolean, the other one that contain the id number of the user that you will need to retrive from the database the user's personal data.

I wrote a very simple function to check the authorization:

function check_auth($lev, $url){
if (@$_SESSION['auth']<$lev) {
header ("Location: http://".ADDRESS.$url);
exit;
}
}

This function check if the level of authorization contained in the session variable "auth" is lower than the one inserted when the function is used and if it is it redirect to the url decided.
The costant ADDRESS contain the website domain.
This function can be used like this:

check_auth(1, "/mypage.php");
// To allow any registered user to see this page
check_auth(2, "/mypage.php");
// To allow just user with an authorization level of two

Usinfg cookie for this purpose wouldn't be secure.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.