When the user is not logged in, the order page first redirects the user to the login page.
Why do I need additional redirection? Why not show the login form in place and after a successful login just redirect to the same page?
here is a short example of the auth.php page
<? if (isset($_POST['auth_name'])) { $name = mysql_real_escape_string($_POST['auth_name']); $pass = MD5($_POST['auth_name'].$_POST['auth_pass']); $query = "SELECT * FROM users WHERE name='$name' AND pass='$pass'"; $res = mysql_query($query) or trigger_error(mysql_error().$query); if ($row = mysql_fetch_assoc($res)) { session_start(); $_SESSION['user_id'] = $row['id']; } header("Location: http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']); exit; } if (isset($_GET['action']) AND $_GET['action']=="logout") { session_start(); session_destroy(); header("Location: http://".$_SERVER['HTTP_HOST']."/"); exit; } if (isset($_REQUEST[session_name()])) session_start(); if (empty($_SESSION['user_id'])) { return; } else { include 'top.php'; ?> <form method="POST"> <input type="text" name="auth_name"><br> <input type="password" name="auth_pass"><br> <input type="submit"><br> </form> <? include 'bottom.php'; } exit; ?>
now you can simply use the next one line to protect any page
require "auth.php";
source share