Member Avatar for dougsix

A web site I'm trying develop has several pages that won't open unless the user is logged in. If not logged in, the user is redirected to a login page that tells the user why they were reditrected.
Prior to the redirection, a SESSION variable stores the path back to the page the user was redirected from.
The user gets to login (user name & password), clicks 'Submit', gets a message that the login was valid.

Then if the user clicks the 'Return' button, I want him returned to the calling page, whichever one it was.

I have tried multitudes of keystrokes to try to make this work, too many to post them all but most are a variation of this:

<input type="submit" class="submit_button" value=" Back " onclick="location.href = <?php echo $linkback; ?> style="font-weight: 700" />

$linkback is the SESSION variable that was set previously pointing back to the calling page. The SESSION data is correct, there is no error, it just refreshes the login page.
Also, the 'Back' fucntion using 'history(-1)' doesn't work because the previous page is not n the history after the redirect to the login page.

Any help would be appreciated.

  • 2 Contributors
  • 2 Replies
  • 201 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by dougsix

Dani AI

Generated

A few practical additions to what and covered — the core problem is a fragile client-side approach combined with a form submit firing. Storing the original page in $_SESSION is fine, but make the return flow robust: prefer a server-side redirect after successful authentication, and always validate and escape the stored URL before using it.

Example — server-side redirect (recommended):

<?php
session_start();
$target = $_SESSION['return_to'] ?? '/';
if (strpos($target, '/') !== 0) { $target = '/'; }   // require a relative path to avoid external redirects
header('Location: ' . $target);
exit;
?>

If you want an on-page control instead of an automatic redirect, use a plain link or a non-submitting button. Output the URL safely with htmlspecialchars() so quotes or user-supplied characters can’t break the attribute:

<a href="<?php echo htmlspecialchars($returnTo, ENT_QUOTES, 'UTF-8'); ?>">Return</a>

Quick checklist and cautions:

  • Call session_start() on every script that reads/writes $_SESSION. Missing that will make the value appear to “disappear.”
  • Store the return path before sending the redirect to the login: e.g. $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
  • Always validate the stored target to prevent open-redirect attacks (allow only relative paths or compare against an allow-list).
  • If using client-side navigation, don’t use an <input type="submit"> for a navigation button — use type="button" or an anchor so the form won’t be re-submitted.

Following the server-side redirect pattern simplifies the flow and avoids the brittle quoting/JS issues that caused the page to reload.

Recommended Answers

All 2 Replies

Member Avatar for jstfsklh211

your getting a js error because your link syntax is wrong

onclick="location.href = <?php echo $linkback; ?>
you need single quotes around the link and your missing the closing double quotes after onclick
onclick="location.href = '<?php echo $linkback; ?>'"
and the submit part of the button is firing causing you to submit your page back to its self

Member Avatar for dougsix

Exactly the help I needed!
The solution worked perfectly (after I corrected a typo) and resolved a problem I had been working on for many hours.

Thanks again.
Dougsix

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.