help with php redirect

[mustafaneguib]

hey all i need some help in redirecting my page. following is my code. here is the scenario:

when the user enters the admin panel from another website set up on a different host/server (a cms actually) the user is redirected to this page and the data from the main website(the control center of the cms system hosted on a different server, the query is made and the data is extracted. then the user is supposed to be redirected back to the admin panel and the data extracted is supposed to displayed on that admin panel.

now the problem that i am having is that this script is not redirecting at all. i have no idea why the script is not being redirected. the header is not working. thanx in advance.

<?php

	 session_start();
	 
	include 'config.php';
	 

	$getnews="SELECT *
			  FROM developmentnews
			  WHERE project_name='Theeta CMS' AND display=1
			  ";
			  
	$querygetnews=mysql_query($getnews) or die(mysql_error());


	$ifnewsexists=mysql_num_rows($querygetnews);

	if($ifnewsexists!=0)
	{

	$newsitem=mysql_fetch_array($querygetnews);
	extract($newsitem);


		$latestversion=$version;
		$news=$content;
		
		
			$go=$_SERVER['SERVER_NAME']."/admin/index.php";
			
			
			$go=$go."?recievednews=1&news=".$news."&version=".$latestversion;

			
	  header("Location: $go");
	  exit(0);

 
	}//end if
	else
	{
	
	$go=$_SERVER['SERVER_NAME']."/admin/index.php";
			 
	$go=$go."?recievednews=1";
		 
	  header("Location: $go ");
		exit(0);
	
	}//end else

	   


	?>

[somedude3488]

I am guessing you never echoed $go to the page. If you would have, you would of noticed that $_SERVER doesn't include http:// which would make that header call fail.

[mustafaneguib]

I am guessing you never echoed $go to the page. If you would have, you would of noticed that $_SERVER doesn't include http:// which would make that header call fail.

ive added http:// but even then the header is not working.
initially i was using $_SERVER which had the http://
but that even did not work.

i know that the header should work, cos it does in different areas of my site. i am quite puzzled about this.

[digital-ether]

Try hardcoding a URL in its place, to make sure you aren't making a mistake.

Turn on error reporting and display all errors.

error_reporting(E_ALL);
ini_set('display_errors', 1);

[mustafaneguib]

i have hard coded the header, http://www.yahoo.com .
i even commented all the code out and only left the header and the exit statement, even then it is not redirecting.

i have placed the error tags before the header code, but i am not too sure whether i should place it there, any ways i am getting the headers already sent error,

Warning: Cannot modify header information - headers already sent by (output started at /home/worldofp/public_html/mntechsolutions.net/getnewstheetacms.php:1) in /home/worldofp/public_html/mntechsolutions.net/getnewstheetacms.php on line 39

[mustafaneguib]

i think the problem is that i am actually calling header twice.
following is the program flow,

homepage of the website->admin control panel accessed via a link
->redirected to the script via a header ->which after some work done is redirected back to the admin page via the header

i think i am getting the headers already sent because i am calling header twice consectively but in different pages. is this allowed? can we redirect two pages consectively via the header ?

[digital-ether]

i have hard coded the header, http://www.yahoo.com .
i even commented all the code out and only left the header and the exit statement, even then it is not redirecting.

i have placed the error tags before the header code, but i am not too sure whether i should place it there, any ways i am getting the headers already sent error,

The problem is that you cannot send any HTTP headers after you have ouput content.

All the output from PHP is sent directly to the the server, which then sends it to the client via HTTP.

In the HTTP Response, you have HTTP Headers, terminated by an empty line, then the HTTP Body. Once you output something from PHP, it goes into the HTTP Body, and thus you cannot send any more HTTP Headers.

You can use the output buffering functions built into PHP.

ob_start();

That should go right at the start of teh PHP script. That will make PHP buffer all output, sot hat you can send http headers at any time, given the buffer has not been released.

[mustafaneguib]

thanx guys, i have found the problem and have rectified the problem.
apparantly the text that i was sending as a variable that was stored in the variable news contained new line characters. so when i was sending that variable as part of a url the header was giving the headers already sent error.

hence i removed the news variable from my logic completely and got the script to work.

[digital-ether]

thanx guys, i have found the problem and have rectified the problem.
apparantly the text that i was sending as a variable that was stored in the variable news contained new line characters. so when i was sending that variable as part of a url the header was giving the headers already sent error.

hence i removed the news variable from my logic completely and got the script to work.

It is a good thing that the header() call failed in your case. ( It likely won't fail if you use output buffering ie: ob_start() )

Having line breaks in HTTP headers is a security issue. So you have to make sure the variables you put in a HTTP header is safe.

eg:

$page_id = $_GET['page_id'];
// very unsafe
header("Location: index.php?page=$page_id");

Anything that comes from the client should be treated as malicious.

Correct way:

$page_id = $_GET['page_id'];
// very unsafe
header("Location: index.php?page=".urlencode($page_id));

More on HTTP Response splitting:
http://www.owasp.org/index.php/HTTP_Response_Splitting