Where to exit after Redirect

[doubledee]

I have a nested IF-THEN-ELSE with different Redirect statements for each path.

 

Would it be okay to just have one exit(); after my IF-THEN-ELSE instead of having one after *each* Redirect?

 

 

Debbie

 

 

 

[RobertP]

as long as it wont fire any unexpected code, then there should be no problems.

[doubledee]

as long as it wont fire any unexpected code, then there should be no problems.

 

Well, I've always been confused about this...

 

How can you "exit" a script if you have already left it via redirect?! 

 

It seems like it is too late at that point, right?!

 

 

Debbie

 

[RobertP]

the header function sends the header. if the browser wants to obey that header is another question. it is possible to turn off the redirect headers for most browsers. don't rely on your visitors hardware.

[doubledee]

the header function sends the header. if the browser wants to obey that header is another question. it is possible to turn off the redirect headers for most browsers. don't rely on your visitors hardware.

 

So this should work, right?

 

if ($articleFound){
	// Redirect to Article.
	header("Location: " . BASE_URL . $_SESSION['returnToPage'] . "#boxComments");

}else{
	// Redirect to Last Page.
	if (isset($_SESSION['returnToPage']) && ($_SESSION['returnToPage'] !== '/account/create.php')){
		// Return to Last Page.
		header("Location: " . BASE_URL . $_SESSION['returnToPage']);
	}else{
		// Go to Home Page.
		header("Location: " . BASE_URL . "/index.php");
	}
}//End of DETERMINE REDIRECT TYPE

// End script.
exit();

 

 

Thanks,

 

 

Debbie

 

[RobertP]

seems good yeah.

[doubledee]

seems good yeah.

 

Thank you, RobertP!!

 

 

Debbie

 

[kicken]

How can you "exit" a script if you have already left it via redirect?! 

 

Sending a location header for a redirect has no effect on how the script runs.  All it does is queue up another header to be sent when the script does exit (or start sending output).  PHP will happily continue to execute your script beyond the header call. As such, it is generally advisable to put an exit after your redirects to tell PHP to stop there rather than keep running the script.  If you don't you may have vulnerabilities in your code that you don't notice because things might "appear" to work successfully.

 

That said, putting your exit after a bunch of if statements that all send various redirects is fine.  You just need to have it somewhere to prevent the remainder of the script from running and possibly doing bad things.

 

[doubledee]

How can you "exit" a script if you have already left it via redirect?! 

 

Sending a location header for a redirect has no effect on how the script runs.  All it does is queue up another header to be sent when the script does exit (or start sending output).  PHP will happily continue to execute your script beyond the header call. As such, it is generally advisable to put an exit after your redirects to tell PHP to stop there rather than keep running the script.  If you don't you may have vulnerabilities in your code that you don't notice because things might "appear" to work successfully.

 

That said, putting your exit after a bunch of if statements that all send various redirects is fine.  You just need to have it somewhere to prevent the remainder of the script from running and possibly doing bad things.

 

Okay, sounds good.

 

Thanks!

 

 

Debbie

 

[scootstah]

You seem to have this sorted but I figured I would leave this anyway. I like to use a function like the one below to handle redirects so that I know the script is always terminated. Plus, the shorthand is nice.

function redirect($url, $type = 'location', $delay = 3)
{
if ($type == 'refresh') {
	header("refresh:$delay;url=$url");
} else {
	header("location:$url");
}

exit;
}

// usage
redirect('http://google.com'); // sends "location" header

redirect('http://google.com', 'refresh', 1); // sends "refresh" header with a 1 second delay