Meta refresh enters into infinite loop

Question

I wrote the following code to delete entries on my SQL table:

echo "<td><a href='protected_page.php?action=delete&id=$id'>Borrar</a></td>";

}
if(($_GET['action'] == 'delete') && isset($_GET['id'])) { 
    $rem = "DELETE FROM busca WHERE id = '".$_GET['id']."'";
    $mysqli->query($rem);
    if($rem) {
        echo "<meta http-equiv='refresh' content='0;URL=/protected_page.php'>";            
    }
}

Once I click the delete link the page enters into an infinite loop.

**Danger**: You are **vulnerable to [SQL injection attacks](http://bobby-tables.com/)** that you need to [defend](http://stackoverflow.com/questions/60174/best-way-to-prevent-sql-injection-in-php) yourself from. — Quentin, Feb 07 '17 at 07:17

score 2 · Accepted Answer · answered Feb 07 '17 at 07:21

Look at your attribute value:

content='0;URL='/protected_page.php''

You are delimiting the value with ' but trying to use ' characters as data inside it.

This isn't possible so what you are really saying is:

content='0;URL='

The correct syntax is:

<meta http-equiv='refresh' content='0;URL=/protected_page.php'>

… without the quotes around the URL portion.

That said, meta refresh is a nasty approach to performing a redirect. An HTTP redirect is better:

<?php header("Location: /protected_page.php"); ?>

You will need to adjust your logic a little. HTTP headers have to be output before the HTTP body, and you're doing your delete & redirect logic in the middle of your HTML output.

As a rule of thumb it is better to put all your business logic (deleting things, fetching data from the database, etc) at the top of your PHP program, and then leave all the business of generating HTML and other output (using variables you populated in the business logic part at the top) at the bottom.

Noted and fixed! Will update the code above to reflect the changes! — Rocko, Feb 07 '17 at 18:32

score 0 · Answer 2 · answered Feb 07 '17 at 07:25

If you really want to use PHP for this, here you go:

//0 = is second after is refresh 
<?php header("Refresh: 0; URL=http://redirect-url"); ?>

If You Want Use HTML for This, Here you Go

//0 = is second after is refresh 
<meta http-equiv="refresh" content="0;http://redirect-url" />

score -1 · Answer 3 · answered Feb 07 '17 at 05:57

-1

use header instead of meta tag as below

if($rem) { 
    header( 'Location: protected_page.php' );          
}

answered Feb 07 '17 at 05:57

AG_

2,589
3
20
32

Meta refresh enters into infinite loop

3 Answers3