无法使用标题重定向（位置:)

Question

I am unable to redirect from the login page of my site to the dashboard. When I try to login by giving the correct username and password it again shows me the login page, but when I access the dashboard of my site by url I can access it which proves that session has started. Below is my code:

<?php

      error_reporting(0);
      session_start();
      include_once '../db.php';

      if(isset($_REQUEST['admsubmit']))
      {

          $result=executeQuery("select * from adminlogin where admname='".htmlspecialchars($_REQUEST['name'],ENT_QUOTES)."' and admpassword='".md5(htmlspecialchars($_REQUEST['password'],ENT_QUOTES))."'");

         // $result=mysql_query("select * from adminlogin where admname='".htmlspecialchars($_REQUEST['name'])."' and admpassword='".md5(htmlspecialchars($_REQUEST['password']))."'");
          if(mysql_num_rows($result)>0)
          {

              $r=mysql_fetch_array($result);
              if(strcmp($r['admpassword'],md5(htmlspecialchars($_REQUEST['password'],ENT_QUOTES)))==0)
              {
                  $_SESSION['admname']=htmlspecialchars_decode($r['admname'],ENT_QUOTES);
                  unset($_GLOBALS['message']);
                  header('Location: admwelcome.php');
              }else
          {
             $_GLOBALS['message']="Check Your user name and Password.";

          }

          }
          else
          {
              $_GLOBALS['message']="Check Your user name and Password.";

          }
          closedb();
      }
 ?>

Answer 1

From my experience with PHP, the problem is you cannot redirect a user after the page buffer has been emptied. The problem is you must send the headers before anything else for them to be recognized. You script sends html data before sending the Location header that causes the user to redirect, that's why redirecting does not work.

To resolve this issue you must start the buffer at the first line of PHP code to prevent html data being sent, and empty it (if the buffer gets full, it will empty automatically) at the end of the file. You can also specify the buffer size in the config file.

To turn on output_buffering add the following line to your .htaccess file

php_flag output_buffering on

To start the buffer you use the ob_start() function (http://www.php.net/manual/ro/function.ob-start.php).

To empty the buffer in case it has not filled, you use the ob_end_flush() function (http://www.php.net/manual/ro/function.ob-end-flush.php).

Your code should be:

<?php

  ob_start(); // start the page buffer so html data is not sent before the header

  error_reporting(0);
  session_start();
  include_once '../db.php';

  if(isset($_REQUEST['admsubmit']))
  {

      $result=executeQuery("select * from adminlogin where admname='".htmlspecialchars($_REQUEST['name'],ENT_QUOTES)."' and admpassword='".md5(htmlspecialchars($_REQUEST['password'],ENT_QUOTES))."'");

     // $result=mysql_query("select * from adminlogin where admname='".htmlspecialchars($_REQUEST['name'])."' and admpassword='".md5(htmlspecialchars($_REQUEST['password']))."'");
      if(mysql_num_rows($result)>0)
      {

          $r=mysql_fetch_array($result);
          if(strcmp($r['admpassword'],md5(htmlspecialchars($_REQUEST['password'],ENT_QUOTES)))==0)
          {
              $_SESSION['admname']=htmlspecialchars_decode($r['admname'],ENT_QUOTES);
              unset($_GLOBALS['message']);
              header('Location: admwelcome.php');
          }else
      {
         $_GLOBALS['message']="Check Your user name and Password.";

      }

      }
      else
      {
          $_GLOBALS['message']="Check Your user name and Password.";

      }
      closedb();
  }

  ob_end_flush(); // empty the buffer and send the html code back to the browser

  ?>

I also use a redirect function so I can redirect more easily:

function redirect($to) {

   header("Location: " . $to);

}

Now you can redirect like this (it seems far more easier to the eye):

redirect("admwelcome.php");

Please rate my answer as I am a new user and can't rate others just yet :-)