如何阻止直接访问我的php文件

Question

I have the following files with flow:

index.html -> login.php -> displayinbox.php

The login.php files confirms the users from database and redirects to displayinbox.php file.

The problem is that if someone just types the direct link to the displayinbox.php page, the script in the page runs.

How can i stop this from happening? I tried the 'define' and 'defined' method, but that just works for the included files i guess. any help?

Answer 1

Use a session value to track if a user is logged in. If !$_SESSION['whatever'], redirect them to the index/login page.

Example:

login.php

session_start();
/* login code here */
$_SESSION['logged_in'] = true;

displayinbox.php

session_start();
if (!$_SESSION['logged_in']) {
    header("Location: login.php");
    exit;
}