在PHP中的“header（）”函数之后执行命令吗？

Question

For example, here:

<?php
    session_start();

    if (!isset($_SESSION['is_logged_in'])) {
        header("Location: login.php");
        die();
    }
?>
<Some HTML content>

Is die() really necessary here ?

Answer 1

Is die() really necessary here ?

It is: Otherwise, the client will still get the HTML code in the response body. The header asks the client to terminate and go to the new page, but it can't force it.

The client can always continue listening to the response, and receive everything output afterwards, which is a fatal security hole e.g. when protecting sensitive data in a login area.