使用PHP阻止某些站点区域

Question

I dont want users to access other users profiles. So this is what I'm doing. Is it fine?

<?php

session_start();

if($_SESSION['username']=='ryan'){
header("location:dash.php");
}
else{
location("location:404.php");
}

?>

is this secure?

Answer 1

This is secure if the user can not modify the value of $_SESSION['username'] to set it to ryan; but you forgot the exit after the header('Location:...').