Member Avatar for noor92

Hello,

I am new to PHP and I would like to do the following: In my website, the user can add a blog but I would like the blog to go to admin first before it gets published ( The admin has the authority to publish or un-publish a blog).
At the moment, the blog appears on the website and in the admin view it shows that it has not been published yet.

this is my code now:

<pre lang="PHP">

header("Location: ");

</pre>

I would like it to do something like //redirect('admin/addBlogs',$data) but still refresh the page. Is that possible?

  • 3 Contributors
  • 2 Replies
  • 242 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by Fernando_4

Dani AI

Generated

— the root problem is not the redirect: the app needs a clear "pending" workflow and the public listing must only show approved posts. Redirecting to an admin URL or including admin scripts on the public page is not necessary and can create security and UX problems.

A practical pattern:

  • store submissions with a server-side status (pending by default),
  • never trust client input for that status,
  • make the public page query only approved posts,
  • give admins a separate authenticated UI to change status.

Example schema (SQL):

CREATE TABLE blogs (
  id INT AUTO_INCREMENT PRIMARY KEY,
  user_id INT NOT NULL,
  title VARCHAR(255) NOT NULL,
  content TEXT NOT NULL,
  status ENUM('pending','published','rejected') NOT NULL DEFAULT 'pending',
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  published_at DATETIME NULL
);

Example server-side snippets (PDO) — insert and public-select:

$stmt = $pdo->prepare(
  "INSERT INTO blogs (user_id,title,content,status) VALUES (:uid,:t,:c,'pending')"
);
$stmt->execute([':uid'=>$userId,':t'=>$title,':c'=>$body]);

$stmt = $pdo->prepare(
  "SELECT id,title,content,created_at FROM blogs WHERE status='published' ORDER BY created_at DESC"
);
$stmt->execute();
$posts = $stmt->fetchAll();

Admin publishes with an update:

$upd = $pdo->prepare(
  "UPDATE blogs SET status='published', published_at=NOW() WHERE id=:id"
);
$upd->execute([':id'=>$id]);

Notes, UX and security checklist:

  • As suggested, a status field + admin UI is the right approach; the code above makes that concrete.
  • Avoid including admin scripts in public pages (as noted) — that risks exposing admin logic and causes awkward double loads. Keep admin routes authenticated.
  • Send a notification (email or dashboard alert) to admins from the server after insert so you "send data to admin" without redirecting users.
  • Always use prepared statements, validate/escape output to prevent XSS, protect admin actions with authentication and CSRF tokens, and ensure users cannot set their post status from the client.
  • Use Post-Redirect-Get on the submission endpoint so the user returns to a clean page with a "submitted, pending approval" message and no accidental resubmits.

Recommended Answers

All 2 Replies

Member Avatar for milil

I don't see logic with your question.
You post like user so you are redirecting to admin, user isn't same as admin so he can't do what admin can...

Hmm, you can do it in this way:
Make a table in database for BlogPost with fileds like createdBy, text, subject, published, etc...
Make a page for user to create a blog, when he add new blog it will add it in to database.
Next make page for admin that will go to database and search for all unpublished posts, executeQuerry that will find every blog where published is false...
Then add button or select when you press publish to make all of them published and the visitor of your website will see only published posts.

Or you can use Wordpress, he have allready implemented that. Bunch of users and admins, you can add restriction what they can do, and so many things...

Member Avatar for Fernando_4

I think you want to use the contents of 'admin/addBlogs' script within the 'user/blogger' script before content is published to the user.

The problem I see is, once a php script finishes execution and sends output to the user the only way to run another php script would be through client/browser action to run that other script. You could trigger that through javascript's on window load event and do the redirect. But it would be wierd seeing two page loads.

Try thinking about including the admin/addBlogs script at the beggining of the user/blogger script to make all your tests before the output.

If there's a certain condition where you don't want any of the following to execute, just type exit(); and nothing else is done, everything up to that statement is what will be sent to the browser.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.