Re: Secure redirection?

I might have not read your post thorougly,
but it's important to know, that Header sends a HTTP request to the browser - you are not hiding the destination URL.

So, calling header("location: in PHP is basically same as redirect using JS.

Martin


Zoran Bogdanov napsal(a):
Hi,

I'm building a login system with AJAX/PHP/MySQL.

I have worked everything out... AJAX is sending request to a php login script (login.php) who if authentication passes initializes the session and sends the header using header("Location : registered_user_area.php");

The whole system works great without AJAX, but when I put AJAX in the story I ahve one problem:

1.When the user is successfully authenticated the login.php sends the header, but the AJAX XMLHttpRequest call is still in progress waiting for a PHP response. So when PHP using the header function redirects to another page that page is outputed to the login form...

My PHP login snippet is:
if ($res_hash == $u_pass) {

$logged_user = $sql_execution->last_query_result->user;

$sql_execution->exec_query("DELETE FROM seeds",false);

$sql_execution->db_disconnect();

session_start();

$_SESSION['user'] = $logged_user;

$host = $_SERVER['HTTP_HOST'];

$url = rtrim(dirname($_SERVER['PHP_SELF']), '/\\') . '/mpls/index.php';

header("Location: http://$host$url";); //--That page ($host$url) is outputed in the login form...

exit();

}

else {

$sql_execution->exec_query("DELETE FROM seeds WHERE id=$row->id",false);

$sql_execution->db_disconnect();

echo 'BLS'; //--This is sent when the password/username is wrong

exit();

}

???

Any help greatly appreciated

Thank you!


.

Relevant Pages

  • RE: [PHP] Secure redirection?
    ... Subject: [PHP] Secure redirection? ... I'm building a login system with AJAX/PHP/MySQL. ... AJAX is sending request to a php login ... The whole system works great without AJAX, but when I put AJAX in the ...
    (php.general)
  • outputting XML from PHP
    ... This is a question about outputting pure XML from PHP, ... request object in an AJAX application. ... This header will replace the "Content-Type" header sent by the web ...
    (comp.lang.php)
  • Re: PHP - D3 subroutine calls?
    ... MVWWW does the login once and then makes the connection available for ... don't think any of the MV vendors have adequately minimized the pain ... your PHP call. ...
    (comp.databases.pick)
  • Re: Ever seen a mail failure like this?
    ... The mail code is straight out ... website to an email address of that same website. ... If you use this MIME message class and set the Return-Path header and ... Find and post PHP jobs ...
    (comp.lang.php)
  • Re: To allow access only from the designated site.
    ... I want to allow access to it only from site "B" login user. ... what capabilities do both servers have, do they have php, does only ... one, which one, does one/both have a database, session support? ... and to a script on siteB, and uses RSA for the form, with B's public ...
    (comp.lang.php)