Security passing variables through browser

[jmayer]

Right now I am using sessions for a login with something like this at the top of each page

 

	session_start();
if(!isset($_SESSION['auth']) && !isset($_SESSION['admin'])){
	session_destroy();
	header("Location: http://localhost/web/");
}elseif(isset($_SESSION['auth']) && !isset($_SESSION['admin'])){
	session_destroy();
	header("Location: http://localhost/web/");
}

 

Now if you tried to go to one of these pages while not being logged in, it redirects you back to the homepage.

However, on some pages like this I pass variables through the URL such as edit_menu?id=10&action=delete.  This code is included in the header of the page.  The problem is, even when I am not logged in, I can type in the url with variables passed through it and it will perform the action and THEN redirect me back to the home page.  It seems to run all the code in the header before redirecting.

 

What would be the best way to deal with this, register all variables to the session? Or would just putting the functions down in the body of the page work?

 

Thanks

[trq]

You need to place an exit() after any calls to header to stop the rest of the script being executed.

 

<?php

  session_start();
  if (!isset($_SESSION['auth']) && !isset($_SESSION['admin'])) {
    session_destroy();
    header("Location: http://localhost/web/");
    exit();
  } elseif (isset($_SESSION['auth']) && !isset($_SESSION['admin'])) {
    session_destroy();
    header("Location: http://localhost/web/");
    exit();
  }

?>

[Liquid Fire]

yea it good practice to use exit() after a header redirect cuase for some reason the script does not always seem to stop after the header();

[Daniel0]

[...] cuase for some reason the script does not always seem to stop after the header();

 

That's because you don't tell it to. PHP does not care what headers you send, it just sends them. PHP is not the thing redirecting, nor is it the web server. It's the browser. The Location header just tells the browser to go somewhere, but the browser can choose to not do so.

[Lukela]

Wow, I learned something new today in PHP.

 

exit();

 

Haha...

[Guardian-Mage]

When using the PHP header() function, it includes the content of the page specified, and executes the rest of the code in BOTH pages.

[trq]

When using the PHP header() function, it includes the content of the page specified

 

No, the header function simply sends a header to the browser and keeps on executing the script. If you happen to send a Location header, the browser will redirect to that page.