PHP Login System problem... Sending errors from page to page...

Question

Hi, I have a login form in every page of a website so the user can login from everywhere. I have a login.php file that I refer to it from the form (using 'action').

I use $_SERVER['HTTP_REFERER'] to redirect the user to the same page he logged in from when he succesfully log in or when he logs out.

But if there was a problem logging in, how can I send an error to the same page he is trying to log in?? I have tried sending the error using $_GET, like this:

// process the script only if the form has been submitted
if (array_key_exists('login', $_POST)) {
    // Login code goes here...

 // If there was a problem, destroy the session and prepare error message
 else {
 $_SESSION = array();
 session_destroy();
 header('Location: '.$_SERVER['HTTP_REFERER'].'?error');
 exit;
}

But the problem is that a lot of pages in the website are like this details.php?mid=0172495. They already recive information from the $_GET method and for security reasons I cant use another $_GET method...

So, How can I pass the error??? Thanks...

Answer 1

I'm not sure what exactly you mean by "for security reasons I cant use another $_GET method", but in the case that there's already something in the query string, you just need to append another variable to it, instead of replacing it.

That is, if the address is like details.php?mid=0172495, you should be sending them to details.php?mid=0172495&error, whereas if it was just details.php, you send them to details.php?error.

Answer 2

To add to what Chad Birch said...

In your login script where you redirect, check the HTTP_REFERER value for the character '?'. If it is present, append '&error' to the HTTP_REFERER and redirect to that. Otherwise append '?error' to the HTTP_REFERER and redirect to that.

Answer 3

Since you're already using sessions, after you destroy the session why not create a new one with $_SESSION['error'] or something similar set? Or alternatively simply don't delete the session at all but set the error which you can immediately check in other pages?

Answer 4

Another way of doing what you need is to include your login.php file in every page that has the login form and just post to that same page. So you won't need any redirection at all.

This maybe is not a good scalable and maintainable solution, but it is simple. It all depends what kind of app you are writing. But you are saying that you are new to php so you can start like this. You can always go fancy later...