aztec Posted January 26, 2008 Share Posted January 26, 2008 Hello Part of my login system is that when a user wishes to login they are directed to a "protected" page that checks to see if they are logged in and if not launches a login page, the login is based on setting a session and works satisfactory. My concern is that although the page is a combination of PHP, CSS and HTML the visitor, should they wish can look at the source code and see the remaining HTML and the calling page hfef. Whilst the calling page is "protected" by showing the calling page it would give someone intent on penetrating the members area a page reference to work on at their leiasure. My question is can this be hidden in the source code. <a href ="membersonly.php"> Login Page</a> Kind Regards Quote Link to comment Share on other sites More sharing options...
revraz Posted January 26, 2008 Share Posted January 26, 2008 Even though they can see it, it really shouldn't matter if the page itself is checking a session. If the session doesn't exist, you should use a header to take them away, so they never see the source of that page. Quote Link to comment Share on other sites More sharing options...
aztec Posted January 26, 2008 Author Share Posted January 26, 2008 Hello Thanks REVAZ You obviously don't think that there is a security problem then. Regarding using a header to take them away, this is new territory for me so two questions, a) do I need to use htaccess for this b) would you point me in the right direction Regards Quote Link to comment Share on other sites More sharing options...
PHP Monkeh Posted January 26, 2008 Share Posted January 26, 2008 The code for re-direction using header is : <?php header("Location: page.php"); ?> Just incase you don't know, you must use header() before anything is output to the browser (even things such as <html>, <body> etc). Quote Link to comment Share on other sites More sharing options...
aztec Posted January 26, 2008 Author Share Posted January 26, 2008 Hello Thanks for your response I had read that but for some reason I thought it was more complicated and involved the use of htaccess. Thanks again for putting me straight. Regards Quote Link to comment Share on other sites More sharing options...
Lumio Posted January 26, 2008 Share Posted January 26, 2008 Don't forget to add exit; after header('Location: '); Or the source may get send Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.