How do I hide the contents of a page unless redirected?

[jessnoonyes]

I have a website where I sell one downloadable product.  Someone pays for it and then is redirected to the download page.  Problem is they could just bookmark the url and go back and download it again all they want.  Is there a way to prevent that from happening?  Somehow set it up so the page only displays if they've been redirected from PayPal perhaps? 

[trq]

You'll need to set a $_SESSION variable prior to the redirect. then, on the page, check that this $_SESSION variable is set.

[jessnoonyes]

I would set that variable on a different page from the download one?

[trq]

Yes.

[jessnoonyes]

I am such a novice when it comes to this.  I'm sorry!  Any help would really be appreciated.  So after a lot of looking around online I understand that a session can be started when a particular page is visited with the start session code, and that session info can be saved and passed along to subsequent pages and would eventually expire and die (right?).  Is this the code I use to start a session:

 

<?php

session_start(); //

?>

 

And then what do I put on the page I want protected to verify that the visitor didn't just type in the url but came from the start session page?

[chigley]

<?php

session_start();

$_SESSION["redirected"] = true;

header("Location: x.php");

?>

 

<?php

session_start();

if(!$_SESSION["redirected"]) {
die("You are viewing this page incorrectly");
}

// Rest of page here

?>

[jessnoonyes]

You rock.  Thanks!  So do I put the first bit of code on my starting page, and the second on the page I want protected?

[chigley]

Yeah

[jessnoonyes]

Do I need to change it at all with my page information or is it good to go?

 

I really appreciate your help!

[chocopi]

The only thing you need to change is the x.php bit to what ever page you redirect to and then you obvioulsy put your code where Chigley put //rest of page here

 

~ Chocopi

[jessnoonyes]

It didn't do anything  ??? I can still type in the url of the page and it opens up.  Wonder what I did wrong.  I put both those snippets of code above the html of the pages, and changed the x.php to the file.html page name I want protected.  Was that right?

[penguin0]

You need to make sure you are not doing this on the page you want protected:

 

<?php

session_start();

$_SESSION["redirected"] = true;

header("Location: x.php");

?>

 

If that code is on the page you want protected then it will always say that redirected = true.