header('Location:') no redirecting

Question

My code was properly working on school server but now I have changed the host and the page does not redirect. I have tried many things but none of them work. Thanks for your help!

My code:

<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
</head>
<?php require_once('baza.php'); ?>
<?php
session_start();

$user=$_POST['user']; 
$pass=$_POST['pass'];

$encrypted_pass=md5($pass);
$sql="SELECT * FROM uporabniki WHERE uporabnik='$user' and geslo='$encrypted_pass'";
$result=mysql_query($sql);


$count=mysql_num_rows($result);

if($count==1){
$_SESSION['user']=$user;
$_SESSION['pass']=$pass;

session_write_close();

header('Location: dostop.php');
}
else {
echo "Napačno uporabniško ime ali geslo.<br>";
echo "<a href='vpis.php'>Nazaj na vpis</a> ali ";
echo "<a href='index.php'>nazaj na Domačo stran.</a>";
}

?>
</html>

See this thread, http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php. and/or https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet — chris85, Sep 19 '15 at 13:28

score 1 · Answer 1 · answered Sep 16 '15 at 18:54

Two things:

Headers can only be sent out before any other output is sent. That includes the lines from the doctype through the head. You need to send the header before that - before even an empty space.
You really need to add a die(); call directly after sending the header. Otherwise, even though the user will be redirected, the rest of the script will continue to execute in the background. This can range from mildly troublesome to absolutely catastrophic, depending on the application.

Thanks a lot! I have moved the php and added `die();` works perfectly now. — endure, Sep 16 '15 at 19:00

score 0 · Answer 2 · answered Sep 16 '15 at 18:57

0

Call die() or exit() function after header()

answered Sep 16 '15 at 18:57

mynawaz

1,599
1
9
16

header('Location:') no redirecting

2 Answers2