i'm trying to redirect a successful login user to his/her specific directory in the root site.
Could I request some guidance in this area?
i'm trying to redirect a successful login user to his/her specific directory in the root site.
Could I request some guidance in this area?
Good thread. is right that an HTTP redirect is the right tool, and 's caution about sanitizing is crucial. For a per-user landing page the safe, maintainable pattern is:
A minimal, safe example (illustrates the checks above):
// after successful auth and $userDir comes from your DB
$dir = basename($userDir); // remove any slashes/traversal
$allowed = ['bmorgan','default']; // build this from DB or config
if (! in_array($dir, $allowed, true)) {
$dir = 'default';
}
header('Location: /users/' . $dir . '/index.php', true, 303);
exit; Extra notes: the redirect must be sent before any output (or use output buffering). Regenerate the session id after login to prevent fixation, use HTTPS and set secure/httponly cookie flags, and never redirect to a URL supplied directly by the user without strict checking (open-redirect risk). If you want to return users to an originally requested page, store that destination in the session before forcing login and validate it against allowed targets after authentication.
Jump to Post— Insensus 52http://php.net/manual/en/function.header.php
This lets you change the HTTP headers which is probably the best way to redirect someone.
Something like:Header("Location: /$directory");Be sure to put it early in your …
Jump to Post— Wraithmanilian 1It also goes without saying to make sure you "sterilize" user input if it is to be used to direct the user to a "password protected" area. Also, I tend to include a header in my code in "admin" areas that check to see if the right person is in …
http://php.net/manual/en/function.header.php
This lets you change the HTTP headers which is probably the best way to redirect someone.
Something like:
Header("Location: /$directory"); Be sure to put it early in your document, before any output is generated, or you will get an error because you can't change the headers anymore.
It also goes without saying to make sure you "sterilize" user input if it is to be used to direct the user to a "password protected" area. Also, I tend to include a header in my code in "admin" areas that check to see if the right person is in the right areas. If not, or if not logged in (say they bookmarked the page and came back much later), then they are redirected to the main login screen.
Good luck!
http://php.net/manual/en/function.header.php
This lets you change the HTTP headers which is probably the best way to redirect someone.
Something like:Header("Location: /$directory");Be sure to put it early in your document, before any output is generated, or you will get an error because you can't change the headers anymore.
Kind of you to reply so quickly!
The challenge for me is that the redirect has to be dynamic, determining a specific url for the specified user.
Here is an example:
User:bmorgan
on login, this user has a specified directory "/bmorgan" in the root folder. I want to direct this user to an index page inside the /bmorgan folder.
Now suppose I store this directory info in my db along with this user's information, how would that work with the Header("Location: ...");?
I trust this is making some sense!
How are you determining if a login is valid or not?
If you are pulling from MySQL, then you can:
<?php
// CODE TO DETERMINE IF LOGIN IS CORRECT
// .........
$url = "http://www.domain.com/".$validusername;
header($url);
?> Remember, like Insensus said, you have to send header() information before you send out ANY output.
Does this make sense?
How are you determining if a login is valid or not?
If you are pulling from MySQL, then you can:
<?php // CODE TO DETERMINE IF LOGIN IS CORRECT // ......... $url = "http://www.domain.com/".$validusername; header($url); ?>Remember, like Insensus said, you have to send header() information before you send out ANY output.
Does this make sense?
Thanks all for the helpful post. I got it to work by doing the following:
<?php
/**
* User has already logged in, so display relavent links, including
* a link to the admin center if the user is an administrator.
*/
if($session->logged_in){
echo "<h1>Logged In</h1>";
echo "Welcome <b>$session->username</b>, you are logged in. <br><br>"
."[<a href=\"userinfo.php?user=$session->username\">My Account</a>] "
."[<a href=\"useredit.php\">Edit Account</a>] ";
echo"
<iframe id=\"login-form\" frameborder=\"0\" scrolling=\"no\" width=\"100%\" src=\"$serverroot.$session->directory/login-form.php\" height=\"400\" align=\"left\"></iframe><br />
";
if($session->isAdmin()){
echo "[<a href=\"admin/admin.php\">Admin Center</a>] ";
}
echo "[<a href=\"process.php\">Logout</a>]";
}
else{
?> We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.