ansaurus

Question

Forcing user to new page in php. (PHP newbie)

Answer 1

A:

What was wrong with this line before you commented it?

//header("location:http://localhost/search7.htm);

That forces the browser off to another page. Two other options though (both go in <head>):

Javascript:

<script type="text/javascript">document.location.href = "http://url";&lt;/script&gt;

Meta refresh:

<meta http-equiv="REFRESH" content="0;url=http://url" />

Oli 2010-06-08 22:30:49

I think you can't echo anything before header().

Babiker 2010-06-08 22:33:29

There's also output buffer code in there (counters that problem). The OP has been through this already.

Oli 2010-06-08 22:35:49

Answer 2

+3 A:

Firstly you've got a SQL injection problem. Always sanitize your form input:

$id = mysql_real_escape_string($_GET['recordID']);

Second, you can use the header() method to redirect the user:

header('Location: http://localhost/search7.htm');

but you can only do this if you haven't sent any output to the user. For this reason you'll often see people using output buffers to give them the option of doing an HTTP redirect. For this reason I find a function like this helpful:

function redirect($url) {
  while (ob_end_clean()) {
    // do nothing
  }
  header("Location: $url");
}

So you can then do this:

<?php
ob_start();
echo "...some html...";
header('Location: /new/url.html'); // this will fail
redirect('/new/url.html'); // this will succeed
...

If you want to display a page temporarily try outputting something like this:

<html>
<head>
  <meta http-equiv="refresh" content="15; url=http://localhost/search7.htm"&gt;
  <title>Delete Record</title>
</head>
<body>
  <p>You have deleted a record.</p>
  <a href="http://localhost/search7.htm"&gt;&lt;&lt;&lt; Back</a>
</body>

This will automatically redirect the user back after 15 seconds if they don't click the back link before then.

cletus 2010-06-08 22:32:01

Wrikken 2010-06-09 01:50:11

@Col. Insulting people doesn't win you any arguments.

Yacoby 2010-06-16 20:52:19

@Col. [sanitize](http://www.merriam-webster.com/dictionary/sanitize): "to make more acceptable by removing unpleasant or undesired features". Ergo mysql_real_escape_string sanitizes input.

Yacoby 2010-06-16 20:53:26

@Yacoby I don't play and I don't need to win anything. I have just pointed to ignorant answer, while the answerer can educate himself with one of numerous links in this topic. And mysql_real_escape_string does not remove any characters. Go figure.

Col. Shrapnel 2010-06-16 23:22:48

Answer 3

A:

The code you have there should work, just like cletus suggested, but you need to put//header("location:http://localhost/search7.htm); before you echo/print anything (html code, php code, etc.) in your page, because it will mean that the headers were already sent. Its better explained here.

realshadow 2010-06-08 22:36:42

Answer 4

A:

When you send a Location header, there's no reason to echo anything to the browser, so you might as well exit() immediately:

<?php 
$id = mysql_real_escape_string($_GET['recordID']);
require_once('connections/local.php'); 
mysql_select_db($database_local, $local);

mysql_query("DELETE FROM user_access WHERE id = '$id'") or die(mysql_error());

header("Location: http://localhost/search7.htm");
exit();
?>

IMPORTANT: You are also vulnerable to SQL injection (fixed above via mysql_real_escape_string)

Dolph 2010-06-08 22:36:46

OMG newbies strikes again. You have fixed nothing.

Col. Shrapnel 2010-06-12 20:01:54

Did you mean to comment on a different answer? This answer fixes two issues.

Dolph 2010-06-13 15:01:56

No, I meant to comment this very ignorant answer. No injection has been fixed.

Col. Shrapnel 2010-06-13 17:24:12

Sorry, I've never used `mysql_real_escape_string`... I used PHP before the function even existed, and have since moved on to mature languages.

Dolph 2010-06-16 20:48:26

@Dolph The code above is fine.

Yacoby 2010-06-16 20:56:05

That's not an excuse. Any slashing function does the same. If you don't know PHP, why bother to answer that language questions at all?

Col. Shrapnel 2010-06-16 23:24:34

@Jacob Relkin, thanks for the correction.

Dolph 2010-06-17 01:16:05

@Dolph, LOL, it was only one character. No problemo ;)

Jacob Relkin 2010-06-17 01:19:55

Answer 5

A:

I recommend looking into an AJAX solution. That way you can delete the record without having to ever navigate away from the search page. A good javascript library will make the operation pretty simple, and it would a fun and interesting project for someone new to web development.

wshato 2010-06-08 22:38:53

Answer 6

A:

Two possible improvements not mentioned in the previous answers:

I would suggest using POST to process your database modifications instead of GET. That way you will avoid accidental deletions if someone has some kind of a web-accelerator installed (a program that pre-fetches web-pages by following / loading all links in a page).
About the sql injection vulnerability problem; if you are talking about a numeric ID, I would use (int) $_GET['recordID'] or intval($_GET['recordID']) to make sure that the ID is an integer. No mysql_real_escape_string() needed.

jeroen 2010-06-16 21:45:56

ansaurus

tags:

views:

answers:

Forcing user to new page in php. (PHP newbie)

related questions