What’s wrong with my HTTP redirect? - php

Question

I’m using the following code to redirect the user if he/she logged in correctly (see comments in code). But I’m getting an error. What am I doing wrong?
<?php
require 'inc/header.php';
require 'inc/config.php';
require 'inc/functions.php';
?>
<?
$login = $_POST['login'];
if($login==1)
{
$username = mysql_escape_string(trim($_POST['username']));
$passwd = mysql_escape_string(trim($_POST['passwd']));
$QUERY = "
SELECT
*
FROM
login
WHERE
username = '$username' and password='$passwd'
";
$result = send_query($QUERY);
$num_rows = mysql_num_rows($result);
$flag=0;
if($num_rows == 0)
{
//show_error('Invalid username');
$flag=1;
}
else
{
//this is correct login so i am trying to forward but i am geting error
//here
header('Location: admin_home.php');
exit;
}
}
?>
<div class="left">
<div class="left_articles">
<h2>ADMIN LOGIN</h2>
<p class="description"><?if($flag== 1 ) echo "invalid login" ; ?> </p>
<p><form action="admin.php" method="POST">
<table border="0">
<tbody>
<tr>
<td>Username</td>
<td><input type="text" name="username" value="" /></td>
</tr>
<tr>
<td>Password</td>
<td><input type="password" name="passwd" value="" /></td>
</tr>
<tr>
<td></td>
<td><input type="submit" value="Login" /></td>
</tr>
<tr>
<td></td>
<td></td>
</tr>
</tbody>
</table>
<input type="hidden" name="login" value="1" />
</form>
</p>
</div>
<B> AFTER LOGING INTO ADMIN PANEL YOU CAN DO FOLLOWING THINGS <B>
<p align="center">
<ul>
<li>Add new Jobtype</li>
<li>Add new Questions</li>
<li>Modify Selection Cretiria</li>
</ul>
</p>
</div>
<div id="right">
<div class="boxtop"></div>
<div class="box">
<p><img src="images/image.gif" alt="Image" title="Image" class="image" /><b>Akshay ipsum dolor sit amet</b><br />consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis.<br /></p>
<div class="buttons"><p>Read Mark</p></div>
</div>
<div class="boxtop"></div>
<div class="box">
<p><img src="images/image.gif" alt="Image" title="Image" class="image" /><b>Pako dolor sit amet</b><br />consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis.<br /></p>
<div class="buttons"><p>Read Mark</p></div>
</div>
</div>
<? require 'inc/footer.php' ?>

Answer 1

You'll want to issue a HTTP Header to redirect the client:
if ($redirect == true) {
//redirect
header("Location: http://www.mysite.com/noauth.php");
//And exit
exit;
}
See PHP Manual on Headers. You need to exercise some care when using headers: they have to be sent before any other output to the client. This includes any rogue white space you might have at the top of your php scripts, which will throw an error if you try and issue a new header.

Answer 2

If you haven't already printed any headers you could use header to redirect as below:
<?php
header("Location: B.php");
?>

Answer 3

Use
Header('Location: filename.php');
and you will be redirected to the filename.php.

Answer 4

This should do:
<?php
header('Location: page.php');
?>
See the header function. For more complicated redirect URLs, you might want to look at the http_redirect function.
You need to make sure you output the headers before outputting any regular content, or it won't work. You can check with headers_sent if necessary.
Content after outputting the HTTP header is allowed, but it won't be shown to the user under most circumstances. Usually it makes sense to just do an exit; right after the header statement.

Answer 5

The header("location: b.php";) is the way to go, on the comment by Thorarin, there should be no more output after the header command, other than either a die; or an exit();. Having content that should not be acted upon may be visible to search engine spiders that do not act upon the header("location"); command and they may follow links on the page that you don't want followed.
Also it wasnt mentioned, but if redirect is to a page that can only be accessed by a person that has logged in, you should be setting a session or use some other method so that you can be sure the person entering b.php actually is a verified / logged in user.
Bill H

Answer 6

header() technically expects a full url (i.e. http://example.com), but that's not the problem here.
headers must be sent before anything else is printed on the page (even whitespace)—take a look at line 5: that's one carriage return, that will cause your header()-call to fail

Answer 7

< ? php
require 'inc/header.php';
require 'inc/config.php';
require 'inc/functions.php';
? >
<-- what about this newline character?
< ?