PHP, is it acceptable to include a php file not at top of the file to get
around the limitations of the header() function?
I apologise for the trivial question, but I have been having problems
using the header() php function to redirect to pages. More specifically I
am struggling to redirect a user when he/she tries to view a non existent
profile page. My problem is that I am always including a header file which
contains session start and some html to display a basic header. Does this
mean I cannot use the header() function to redirect to pages in my scripts
that include this header file? I thought one way to get around the problem
might be to split the html part of the header into a separate file, and
include the header scripts first, then write my profile scripts, and
finally include the html part of the header. Is that bad practice? the
profile.php script follows:
<?php include("inc/incfiles/header.inc.php"); ?>
<?php
if(isset($_GET['u'])) {
//check user exists
$username = mysql_real_escape_string($_GET['u']);
if (ctype_alnum($username)) {
$check = mysql_query("SELECT username, email FROM users WHERE
username = '$username'");
if (mysql_num_rows($check)===1) {
$get = mysql_fetch_assoc($check); //execute query and store in
array
$username = $get['username'];
$email = $get['email'];
}
else {
header("Location: index.php");
die();
}
}
else {
echo "username has to be alphanumeric";
}
}
else {
echo "error";
}
?>
<h2> Profile page of <?php echo "$username";?>
<h3> Email: <?php echo "$email";?>
header.inc.php file:
<?php
include ("inc/scripts/mysql_connect.inc.php");
//start the session
session_start();
//Checks whether the user is logged in
$user = $_SESSION["user_login"];
if (!isset($SESSION["user_login"])) {
//header("Location: index.php");
//exit();
}
else
{
header("location: home.php");
}
?>
<?php
//Login Scripts has to be at the top to make sure header() redirecting works
if (isset($_POST["user_login"]) && isset($_POST["password_login"])) {
$user_login = preg_replace('#[^A-Za-z0-9]#i','', $_POST["user_login"]);
//filter user login text
$password_login = preg_replace('#[^A-Za-z0-9]#i','',
$_POST["password_login"]); //filter user password text
$md5password_login = md5($password_login);
$sql = mysql_query("SELECT id FROM users WHERE username='$user_login' AND
password='$md5password_login' LIMIT 1"); //query the user
//Check for user's existence
$userCount = mysql_num_rows($sql); //count number of rows
if ($userCount == 1) {
while ($row = mysql_fetch_array($sql)) {
$id = $row["id"];
}
$_SESSION["user_login"] = $user_login;
$_SESSION["password_login"] = $md5password_login;
header("Location: home.php");
exit();
}
else {
echo "That information is incorrect, try again";
}
}
?>
<html>
<head>
<link href = "css/main.css" rel = "stylesheet" type = "text/css">
<title> title </title>
</head>
<body>
<div class = "wrapper">
<div id = "header">
<div class = "logo">
<img src = "img/Logo.png">
</div>
<div id = "login-header">
<form action = "index.php" method ="post" name =
"form1" id = "form1">
<div class = "input-wrapper"><input type =
"text" size = "25" name = "user_login" id =
"user_login" placeholder = ">Username" ></div>
<div class = "input-wrapper"><input type =
"password" size = "25" name = "password_login"
id = "password_login" placeholder = "Password"
></div>
<div class = "input-wrapper"><input type =
"submit" name = "login" value = "Sign
in"></div>
</form>
</div>
<div id = "menu">
<a href = "#"></a>
<a href = "#"></a>
</div>
</div>
</div>
No comments:
Post a Comment