HTTP Redirect / Header... When to call it - php

Question

on my website, at the top of every php page, I have an
include_once 'header.php';
This file contains HTML.
In my file, 'authenticate.php', I want to have a redirect after logging in back to the index.
My code is the following:
header('Location: http://www.URLHERE.com/index.php');
However after submitting, the page just refreshes. It doesn't redirect. The redirect worked properly on my localhost dev server, but as soon as I uploaded it online, it stopped working.
Is this because my header contains HTML, which is called before the header() function? Note that all HTML in the 'header.php' file is in HEREDOC tags.
Here is my code:
<?php // login.php
include_once 'header.php';
include_once 'functions.php';
require_once 'login_users.php';
$db_server = mysql_connect($db_hostname, $db_username, $db_password);
if (!$db_server) die("Unable to connect to database:" . mysql_error());
mysql_select_db($db_database)
or die("Unable to find database:" . mysql_error());
if (isset($_POST['username']) &&
isset($_POST['pw_temp']))
{
$username = sanitizeString($_POST['username']);
$pw_temp = sanitizeString($_POST['pw_temp']);
$pw_temp = md5($pw_temp);
$query = "SELECT username,password FROM users WHERE username='$username' AND password='$pw_temp'";
if (mysql_num_rows(mysql_query($query)) == 0)
{
die("Wrong info");
}
else
{
$_SESSION['username'] = $username;
$_SESSION['password'] = $pw_temp;
$_SESSION['ipaddress'] = $_SERVER['REMOTE_ADDR'];
header('Location: http://www.URLHERE.com/index.php');
}
}
...more code down here

Answer 1

on my website, at the top of every php page, I have an include_once 'header.php';
This is what you are doing wrong.
What it have to be
<?php // login.php
include_once 'functions.php';
require_once 'login_users.php';
// some code
include 'output.php'; // ONLY HERE output starts.
Here you can see a concise but complete example with some explanations and reasoning. But the main reason for getting rid of your header.php and start using templates is the very question you asked.

Answer 2

You can do the include in else, remove the include_once 'header.php'; from the top file lines an do it like this:
if (isset($_POST['username']) &&
isset($_POST['pw_temp']))
{
$username = sanitizeString($_POST['username']);
$pw_temp = sanitizeString($_POST['pw_temp']);
$pw_temp = md5($pw_temp);
$query = "SELECT username,password FROM users WHERE username='$username' AND password='$pw_temp'";
if (mysql_num_rows(mysql_query($query)) == 0)
{
die("Wrong info");
}
else
{
$_SESSION['username'] = $username;
$_SESSION['password'] = $pw_temp;
$_SESSION['ipaddress'] = $_SERVER['REMOTE_ADDR'];
header('Location: http://www.URLHERE.com/index.php');
}
}
else
{
include_once 'header.php';
//..... now your code!!!!!
}

Answer 3

Maybe it's because of code that you're executing after setting header? Add die after that line (header is not stopping execution!).