When you use header , you cannot output anything in the body of the document, making any alert() impossible impossible.
A commonly used trick for this is delegating alert() ing to the landing page:
header( 'Location: http://localhost/assignment/WebForm.htm?alert='. urlencode("Hello!")) ;
and then in WebForm.htm:
<?php if (isset($_GET["alert"])): ?> <script type="text/javascript"> alert("<?php echo htmlentities(urldecode($_GET["alert"])); ?>"); </script> <?php endif; ?>
just remember the htmlentities() output when outputting the message.
If you already use sessions for 100% security and elegant URLs, you can also create a random key in PHP using rand , save the message in $_SESSION["message_$randomKey"] and pass the key to the GET request. So the only thing that the user sees in the URL is the key, not the message.
source share