i'm trying to redirect a successful login user to his/her specific directory in the root site.

Could I request some guidance in this area?

Dani AI

Generated

Good thread. is right that an HTTP redirect is the right tool, and 's caution about sanitizing is crucial. For a per-user landing page the safe, maintainable pattern is:

  • Authenticate the user.
  • Look up the canonical landing path for that user in the database (do not accept a raw URL from a POST/GET).
  • Normalize and validate that value (strip path characters, compare against a whitelist or the DB of allowed directories).
  • Send a redirect and stop execution (use a 303 after a POST login to avoid form resubmission), then exit.

A minimal, safe example (illustrates the checks above):

// after successful auth and $userDir comes from your DB
$dir = basename($userDir);               // remove any slashes/traversal
$allowed = ['bmorgan','default'];        // build this from DB or config
if (! in_array($dir, $allowed, true)) {
    $dir = 'default';
}
header('Location: /users/' . $dir . '/index.php', true, 303);
exit;

Extra notes: the redirect must be sent before any output (or use output buffering). Regenerate the session id after login to prevent fixation, use HTTPS and set secure/httponly cookie flags, and never redirect to a URL supplied directly by the user without strict checking (open-redirect risk). If you want to return users to an originally requested page, store that destination in the session before forcing login and validate it against allowed targets after authentication.

Recommended Answers

All 5 Replies

http://php.net/manual/en/function.header.php

This lets you change the HTTP headers which is probably the best way to redirect someone.
Something like:

Header("Location: /$directory");

Be sure to put it early in your document, before any output is generated, or you will get an error because you can't change the headers anymore.

It also goes without saying to make sure you "sterilize" user input if it is to be used to direct the user to a "password protected" area. Also, I tend to include a header in my code in "admin" areas that check to see if the right person is in the right areas. If not, or if not logged in (say they bookmarked the page and came back much later), then they are redirected to the main login screen.

Good luck!

http://php.net/manual/en/function.header.php

This lets you change the HTTP headers which is probably the best way to redirect someone.
Something like:

Header("Location: /$directory");

Be sure to put it early in your document, before any output is generated, or you will get an error because you can't change the headers anymore.

Kind of you to reply so quickly!

The challenge for me is that the redirect has to be dynamic, determining a specific url for the specified user.

Here is an example:

User:bmorgan
on login, this user has a specified directory "/bmorgan" in the root folder. I want to direct this user to an index page inside the /bmorgan folder.

Now suppose I store this directory info in my db along with this user's information, how would that work with the Header("Location: ...");?

I trust this is making some sense!

How are you determining if a login is valid or not?

If you are pulling from MySQL, then you can:

<?php

// CODE TO DETERMINE IF LOGIN IS CORRECT

// .........

$url = "http://www.domain.com/".$validusername;
header($url);

?>

Remember, like Insensus said, you have to send header() information before you send out ANY output.

Does this make sense?

How are you determining if a login is valid or not?

If you are pulling from MySQL, then you can:

<?php

// CODE TO DETERMINE IF LOGIN IS CORRECT

// .........

$url = "http://www.domain.com/".$validusername;
header($url);

?>

Remember, like Insensus said, you have to send header() information before you send out ANY output.

Does this make sense?

Thanks all for the helpful post. I got it to work by doing the following:

<?php
/**
 * User has already logged in, so display relavent links, including
 * a link to the admin center if the user is an administrator.
 */
if($session->logged_in){
   echo "<h1>Logged In</h1>";
   echo "Welcome <b>$session->username</b>, you are logged in. <br><br>"
       ."[<a href=\"userinfo.php?user=$session->username\">My Account</a>] &nbsp;&nbsp;"
       ."[<a href=\"useredit.php\">Edit Account</a>] &nbsp;&nbsp;";
       echo"
       <iframe id=\"login-form\" frameborder=\"0\" scrolling=\"no\" width=\"100%\"  src=\"$serverroot.$session->directory/login-form.php\" height=\"400\" align=\"left\"></iframe><br /> 
";
   if($session->isAdmin()){
      echo "[<a href=\"admin/admin.php\">Admin Center</a>] &nbsp;&nbsp;";
   }
   echo "[<a href=\"process.php\">Logout</a>]";
}
else{
?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.