Redirect to referring page after successful login

I have PHP Login System with Admin Features incorporated into one of my websites and it works great.

One thing I would like to change is the page you are sent to after you login. Currently process.php is set to

/* Login successful */
if($retval){
header("Location: index.php");

How could I set this script up to refer the user back to the page that sent them to login.php to begin with?

Currently clicking on a secure page goes like this: securepage.php -> login.php -> index.php -> then click on securepage.php again.

I'd like it to go like this after clicking a secure page: securepage.php -> login.php -> refer back to securepage.php

I could always put a message on the main page saying you must login "first" but not all pages require users to be logged in. The web page is used as a shipping/receiving log and anyone can look at the log but only registered users can create or edit entries.

Could you somehow save the referring url into a variable and then tell the script to go to that url if login was successful?

Thanks for your help...

well if you are always going to want to send the user back to securepage.php i dont see why you can edit:

Code:


/* Login successful */
if($retval){
header("Location: index.php");

and change it to:

Code:


/* Login successful */
if($retval){
header("Location: securepage.php");

alternatively, if you have some users coming from securepage1.php other from securepage2.php and other still from securepage3.php and you want each user redirected back to the page they came from you can try out $_SERVER['HTTP_REFERER']. in short... when a user visits a page their browser collects data. $_SERVER['HTTP_REFERER'] accesses that data to find out the address of the page (if any) which referred the user to the current page. but be warned, it doesnt always work as you plan it to. Read more about it here.

And finally (im just pulling this stuff off the top of my head!) if you have the same situation as described above but dont want to use $_SERVER['HTTP_REFERER'], im sure on securepage.php im sure you have some sort of link to get people to login.php. if its a form you can always include a hidden input telling the script where it came from so login.php knows where it should go next. If its a regular text link you can put something in the url telling login.php where it came from. for example, if your link were something like www.yoursite.com/login.php?r=sp2 then you could use $_GET in login.php to find the value of r. in this case r is sp2 which would mean the user came from securepage2.php. of course if you are going to use $_GET (for this purpose or any other) be sure to do a fair amount of error checking to make sure r is a value you were expecting and not something malicious. you dont need some evil user switching the value of r so your site then redirects to some evil script that exploits some security issue in your website.

Linchpin311 thank you for the reply, securpage.php was just an example, there would be several secure pages that would lead the user to login.php. I will look into $_SERVER['HTTP_REFERER'] and see how it could incorporated into this script.

I'm new with php so i'm a bit lost, maybe my question is a bit dummy, but I don't know what's the problem.

I want to redirect users to a page after login, I change the code of process.php to:

* Login successful */
if($retval){
//after: header("Location: ".$session->referrer);
header("Location: noadmin.php");
}

but when I login, I don't go to noadmin.php, I just stay on a blank page of process.php.

Someone can help?

first off let me say i hope noadmin.php is just a dummy name youre using as an example for the forum. if your page is really named noadmin.php i would change it immediately. a name like that makes people think there is an admin.php page (which unless you renamed it, there is) and you dont want anyone to try to hack your admin.php page. thats just bad news...

on to your question though. a blank process.php page you say? sounds like some sort of php error. so i start with a few regular questions for you. are you running this script on a local or live server? im going to go ahead and assume that error reporting is off so can you turn it on (try putting error_reporting(E_ALL) somewhere in constants.php) and re-run the script to see if php gives you any errors? if it does give you an error be sure to copy and paste it here so we can see it.

first of all, thanks for your help!

the name of the script noadmin.php is just dummy, i'm doing tests to undersand how the login system works. For the moment i'm working on a local server, but the idea is to move it to a live server, but this will on the future.

I turned on the error reporting and re-run the script, but I didn't get any error...

Another strange behavior is when I register a new user: I enter to the user's page but when I logout I come back again to the blanck page of process.php. Any idea? (thanks in advance)

alright well, there really shouldnt be any reason you should ever see process.php directly because it has a few lines to detect why you would be getting redirecting there. and if your there for any invalid reason it redirects you out of there and back to main.php.

and if you still arent seeing an error somethings up. oh man, i just re-read my post and realized i dont have a semicolon at the end of the error reporting line. the error reporting line should look exactly like error_reporting(E_ALL); and it should be on a line all on its own. try putting it directly below the opening php tag (<?php) on constants.php.

if you are still experiencing a blank process.php page i think you're going to need to post the contents of process.php

I put the semicolon at first time, don't worry. But I still have the same problem....

Here is my process.php. I want to remember I didn't change the code, just add some echo's to follow the flow

Code:

<?php
/**
 * Process.php
 *
 * The Process class is meant to simplify the task of processing
 * user submitted forms, redirecting the user to the correct
 * pages if errors are found, or if form is successful, either
 * way. Also handles the logout procedure.
 *
 * Written by: Jpmaster77 a.k.a. The Grandmaster of C++ (GMC)
 * Last Updated: August 19, 2004
 */
include("include/session.php");

class Process
{
  /* Class constructor */
  function Process(){
      global $session;
      /* User submitted login form */
      if(isset($_POST['sublogin'])){
        //echo sublogin;
        $this->procLogin();
      }
      /* User submitted registration form */
      else if(isset($_POST['subjoin'])){
        //echo subjoin;
        $this->procRegister();
      }
      /* User submitted forgot password form */
      else if(isset($_POST['subforgot'])){
        //echo subforgot;
        $this->procForgotPass();
      }
      /* User submitted edit account form */
      else if(isset($_POST['subedit'])){
        //echo subedit;
        $this->procEditAccount();
      }
      /**
      * The only other reason user should be directed here
      * is if he wants to logout, which means user is
      * logged in currently.
      */
      else if($session->logged_in){
        // echo login;
        $this->procLogout();
      }
      /**
      * Should not get here, which means user is viewing this page
      * by mistake and therefore is redirected.
      */
      else{
          //echo otro;
          header("Location: index.php");
      }
  }

  /**
    * procLogin - Processes the user submitted login form, if errors
    * are found, the user is redirected to correct the information,
    * if not, the user is effectively logged in to the system.
    */
  function procLogin(){
      global $session, $form;
      /* Login attempt */
      $retval = $session->login($_POST['user'], $_POST['pass'], isset($_POST['remember']));
      /*
      *  Login successful */
      if($retval){
        //after: header("Location: ".$session->referrer);
          header("Location: noadmin.php");
      }
      /* Login failed */
      else{
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
          //echo "  No loged";
        //header("Location: ".$session->referrer);
        header("Location: index.php");

      }
  }

  /**
    * procLogout - Simply attempts to log the user out of the system
    * given that there is no logout form to process.
    */
  function procLogout(){
      global $session;
      $retval = $session->logout();
      header("Location: index.php");
  }

  /**
    * procRegister - Processes the user submitted registration form,
    * if errors are found, the user is redirected to correct the
    * information, if not, the user is effectively registered with
    * the system and an email is (optionally) sent to the newly
    * created user.
    */
  function procRegister(){
      global $session, $form;
      /* Convert username to all lowercase (by option) */
      if(ALL_LOWERCASE){
        $_POST['user'] = strtolower($_POST['user']);
      }
      /* Registration attempt */
      $retval = $session->register($_POST['user'], $_POST['pass'], $_POST['email']);

      /* Registration Successful */
      if($retval == 0){
        $_SESSION['reguname'] = $_POST['user'];
        $_SESSION['regsuccess'] = true;
        header("Location: ".$session->referrer);
        // echo "retval = 0 ";
     
      }
      /* Error found with form */
      else if($retval == 1){
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
        header("Location: ".$session->referrer);
        //echo " retval = 1 ";
      }
      /* Registration attempt failed */
      else if($retval == 2){
        $_SESSION['reguname'] = $_POST['user'];
        $_SESSION['regsuccess'] = false;
        header("Location: ".$session->referrer);
        // echo " retval = 2 ";
      }
  }

  /**
    * procForgotPass - Validates the given username then if
    * everything is fine, a new password is generated and
    * emailed to the address the user gave on sign up.
    */
  function procForgotPass(){
      global $database, $session, $mailer, $form;
      /* Username error checking */
      $subuser = $_POST['user'];
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered<br>");
      }
      else{
        /* Make sure username is in database */
        $subuser = stripslashes($subuser);
        if(strlen($subuser) < 5 || strlen($subuser) > 30 ||
            !eregi("^([0-9a-z])+$", $subuser) ||
            (!$database->usernameTaken($subuser))){
            $form->setError($field, "* Username does not exist<br>");
        }
      }

      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
      }
      /* Generate new password and email it to user */
      else{
        /* Generate new password */
        $newpass = $session->generateRandStr(8);

        /* Get email of user */
        $usrinf = $database->getUserInfo($subuser);
        $email  = $usrinf['email'];

        /* Attempt to send the email with new password */
        if($mailer->sendNewPass($subuser,$email,$newpass)){
            /* Email sent, update database */
            $database->updateUserField($subuser, "password", md5($newpass));
            $_SESSION['forgotpass'] = true;
        }
        /* Email failure, do not change password */
        else{
            $_SESSION['forgotpass'] = false;
        }
      }

      header("Location: ".$session->referrer);
  }

  /**
    * procEditAccount - Attempts to edit the user's account
    * information, including the password, which must be verified
    * before a change is made.
    */
  function procEditAccount(){
      global $session, $form;
      /* Account edit attempt */
      $retval = $session->editAccount($_POST['curpass'], $_POST['newpass'], $_POST['email']);

      /* Account edit successful */
      if($retval){
        $_SESSION['useredit'] = true;
        header("Location: ".$session->referrer);
      }
      /* Error found with form */
      else{
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
        header("Location: ".$session->referrer);
      }
  }
};

/* Initialize process */
$process = new Process;

?>

i wasnt able to duplicate the problem with what you have given me. have you made any changes to session.php that may invoke an error in process.php?

would you mind sharing your session.php with me?

Of course i share it! Anything necessary.. i'm begining to be deseperate..

Code:

<?php
/**
 * Session.php
 *
 * The Session class is meant to simplify the task of keeping
 * track of logged in users and also guests.
 *
 * Written by: Jpmaster77 a.k.a. The Grandmaster of C++ (GMC)
 * Last Updated: August 19, 2004
 */
include("database.php");
include("mailer.php");
include("form.php");

class Session
{
  var $username;    //Username given on sign-up
  var $userid;      //Random value generated on current login
  var $userlevel;    //The level to which the user pertains
  var $time;        //Time user was last active (page loaded)
  var $logged_in;    //True if user is logged in, false otherwise
  var $userinfo = array();  //The array holding all user info
  var $url;          //The page url current being viewed
  var $referrer;    //Last recorded site page viewed
  /**
    * Note: referrer should really only be considered the actual
    * page referrer in process.php, any other time it may be
    * inaccurate.
    */

  /* Class constructor */
  function Session(){
      $this->time = time();
      $this->startSession();
  }

  /**
    * startSession - Performs all the actions necessary to
    * initialize this session object. Tries to determine if the
    * the user has logged in already, and sets the variables
    * accordingly. Also takes advantage of this page load to
    * update the active visitors tables.
    */
  function startSession(){
      global $database;  //The database connection
      session_start();  //Tell PHP to start the session

      /* Determine if user is logged in */
      $this->logged_in = $this->checkLogin();

      /**
      * Set guest value to users not logged in, and update
      * active guests table accordingly.
      */
      if(!$this->logged_in){
        $this->username = $_SESSION['username'] = GUEST_NAME;
        $this->userlevel = GUEST_LEVEL;
        $database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);
      }
      /* Update users last active timestamp */
      else{
        $database->addActiveUser($this->username, $this->time);
      }

      /* Remove inactive visitors from database */
      $database->removeInactiveUsers();
      $database->removeInactiveGuests();

      /* Set referrer page */
      if(isset($_SESSION['url'])){
        $this->referrer = $_SESSION['url'];
      }else{
        $this->referrer = "/";
      }

      /* Set current url */
      $this->url = $_SESSION['url'] = $_SERVER['PHP_SELF'];
  }

  /**
    * checkLogin - Checks if the user has already previously
    * logged in, and a session with the user has already been
    * established. Also checks to see if user has been remembered.
    * If so, the database is queried to make sure of the user's
    * authenticity. Returns true if the user has logged in.
    */
  function checkLogin(){
      global $database;  //The database connection
      /* Check if user has been remembered */
      if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
        $this->username = $_SESSION['username'] = $_COOKIE['cookname'];
        $this->userid  = $_SESSION['userid']  = $_COOKIE['cookid'];
      }

      /* Username and userid have been set and not guest */
      if(isset($_SESSION['username']) && isset($_SESSION['userid']) &&
        $_SESSION['username'] != GUEST_NAME){
        /* Confirm that username and userid are valid */
        if($database->confirmUserID($_SESSION['username'], $_SESSION['userid']) != 0){
            /* Variables are incorrect, user not logged in */
            unset($_SESSION['username']);
            unset($_SESSION['userid']);
            return false;
        }

        /* User is logged in, set class variables */
        $this->userinfo  = $database->getUserInfo($_SESSION['username']);
        $this->username  = $this->userinfo['username'];
        $this->userid    = $this->userinfo['userid'];
        $this->userlevel = $this->userinfo['userlevel'];
        return true;
      }
      /* User not logged in */
      else{
        return false;
      }
  }

  /**
    * login - The user has submitted his username and password
    * through the login form, this function checks the authenticity
    * of that information in the database and creates the session.
    * Effectively logging in the user if all goes well.
    */
  function login($subuser, $subpass, $subremember){
      global $database, $form;  //The database and form object

      /* Username error checking */
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered");
      }
      else{
        /* Check if username is not alphanumeric */
        if(!eregi("^([0-9a-z])*$", $subuser)){
            $form->setError($field, "* Username not alphanumeric");
        }
      }

      /* Password error checking */
      $field = "pass";  //Use field name for password
      if(!$subpass){
        $form->setError($field, "* Password not entered");
      }

      /* Return if form errors exist */
      if($form->num_errors > 0){
        // echo 1;
          return false;
      }

      /* Checks that username is in database and password is correct */
      $subuser = stripslashes($subuser);
      $result = $database->confirmUserPass($subuser, md5($subpass));

      /* Check error codes */
      if($result == 1){
        $field = "user";
        $form->setError($field, "* Username not found");
      }
      else if($result == 2){
        $field = "pass";
          //echo pass;
          $form->setError($field, "* Invalid password");
      }

      /* Return if form errors exist */
      if($form->num_errors > 0){
        // echo 2;
          return false;
      }

      /* Username and password correct, register session variables */
      $this->userinfo  = $database->getUserInfo($subuser);
      $this->username  = $_SESSION['username'] = $this->userinfo['username'];
      $this->userid    = $_SESSION['userid']  = $this->generateRandID();
      $this->userlevel = $this->userinfo['userlevel'];

      /* Insert userid into database and update active users table */
      $database->updateUserField($this->username, "userid", $this->userid);
      $database->addActiveUser($this->username, $this->time);
      $database->removeActiveGuest($_SERVER['REMOTE_ADDR']);

      /**
      * This is the cool part: the user has requested that we remember that
      * he's logged in, so we set two cookies. One to hold his username,
      * and one to hold his random value userid. It expires by the time
      * specified in constants.php. Now, next time he comes to our site, we will
      * log him in automatically, but only if he didn't log out before he left.
      */
      if($subremember){
        setcookie("cookname", $this->username, time()+COOKIE_EXPIRE, COOKIE_PATH);
        setcookie("cookid",  $this->userid,  time()+COOKIE_EXPIRE, COOKIE_PATH);
      }

      /* Login completed successfully */
      return true;
  }

  /**
    * logout - Gets called when the user wants to be logged out of the
    * website. It deletes any cookies that were stored on the users
    * computer as a result of him wanting to be remembered, and also
    * unsets session variables and demotes his user level to guest.
    */
  function logout(){
      global $database;  //The database connection
      /**
      * Delete cookies - the time must be in the past,
      * so just negate what you added when creating the
      * cookie.
      */
      if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
        setcookie("cookname", "", time()-COOKIE_EXPIRE, COOKIE_PATH);
        setcookie("cookid",  "", time()-COOKIE_EXPIRE, COOKIE_PATH);
      }

      /* Unset PHP session variables */
      unset($_SESSION['username']);
      unset($_SESSION['userid']);

      /* Reflect fact that user has logged out */
      $this->logged_in = false;

      /**
      * Remove from active users table and add to
      * active guests tables.
      */
      $database->removeActiveUser($this->username);
      $database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);

      /* Set user level to guest */
      $this->username  = GUEST_NAME;
      $this->userlevel = GUEST_LEVEL;
  }

  /**
    * register - Gets called when the user has just submitted the
    * registration form. Determines if there were any errors with
    * the entry fields, if so, it records the errors and returns
    * 1. If no errors were found, it registers the new user and
    * returns 0. Returns 2 if registration failed.
    */
  function register($subuser, $subpass, $subemail){
      global $database, $form, $mailer;  //The database, form and mailer object

      /* Username error checking */
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered");
      }
      else{
        /* Spruce up username, check length */
        $subuser = stripslashes($subuser);
        if(strlen($subuser) < 5){
            $form->setError($field, "* Username below 5 characters");
        }
        else if(strlen($subuser) > 30){
            $form->setError($field, "* Username above 30 characters");
        }
        /* Check if username is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", $subuser)){
            $form->setError($field, "* Username not alphanumeric");
        }
        /* Check if username is reserved */
        else if(strcasecmp($subuser, GUEST_NAME) == 0){
            $form->setError($field, "* Username reserved word");
        }
        /* Check if username is already in use */
        else if($database->usernameTaken($subuser)){
            $form->setError($field, "* Username already in use");
        }
        /* Check if username is banned */
        else if($database->usernameBanned($subuser)){
            $form->setError($field, "* Username banned");
        }
      }

      /* Password error checking */
      $field = "pass";  //Use field name for password
      if(!$subpass){
        $form->setError($field, "* Password not entered");
      }
      else{
        /* Spruce up password and check length*/
        $subpass = stripslashes($subpass);
        if(strlen($subpass) < 4){
            $form->setError($field, "* Password too short");
        }
        /* Check if password is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", ($subpass = trim($subpass)))){
            $form->setError($field, "* Password not alphanumeric");
        }
        /**
          * Note: I trimmed the password only after I checked the length
          * because if you fill the password field up with spaces
          * it looks like a lot more characters than 4, so it looks
          * kind of stupid to report "password too short".
          */
      }

      /* Email error checking */
      $field = "email";  //Use field name for email
      if(!$subemail || strlen($subemail = trim($subemail)) == 0){
        $form->setError($field, "* Email not entered");
      }
      else{
        /* Check if valid email address */
        $regex = "^[_+a-z0-9-]+(\.[_+a-z0-9-]+)*"
                ."@[a-z0-9-]+(\.[a-z0-9-]{1,})*"
                ."\.([a-z]{2,}){1}$";
        if(!eregi($regex,$subemail)){
            $form->setError($field, "* Email invalid");
        }
        $subemail = stripslashes($subemail);
      }

      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
          //!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! return 1;
          return 1;  //Errors with form
      }
      /* No errors, add the new account to the */
      else{
        if($database->addNewUser($subuser, md5($subpass), $subemail)){
            if(EMAIL_WELCOME){
              $mailer->sendWelcome($subuser,$subemail,$subpass);
            }
            return 0;  //New user added succesfully
        }else{
            return 2;  //Registration attempt failed
        }
      }
  }

  /**
    * editAccount - Attempts to edit the user's account information
    * including the password, which it first makes sure is correct
    * if entered, if so and the new password is in the right
    * format, the change is made. All other fields are changed
    * automatically.
    */
  function editAccount($subcurpass, $subnewpass, $subemail){
      global $database, $form;  //The database and form object
      /* New password entered */
      if($subnewpass){
        /* Current Password error checking */
        $field = "curpass";  //Use field name for current password
        if(!$subcurpass){
            $form->setError($field, "* Current Password not entered");
        }
        else{
            /* Check if password too short or is not alphanumeric */
            $subcurpass = stripslashes($subcurpass);
            if(strlen($subcurpass) < 4 ||
              !eregi("^([0-9a-z])+$", ($subcurpass = trim($subcurpass)))){
              $form->setError($field, "* Current Password incorrect");
            }
            /* Password entered is incorrect */
            if($database->confirmUserPass($this->username,md5($subcurpass)) != 0){
              $form->setError($field, "* Current Password incorrect");
            }
        }

        /* New Password error checking */
        $field = "newpass";  //Use field name for new password
        /* Spruce up password and check length*/
        $subpass = stripslashes($subnewpass);
        if(strlen($subnewpass) < 4){
            $form->setError($field, "* New Password too short");
        }
        /* Check if password is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", ($subnewpass = trim($subnewpass)))){
            $form->setError($field, "* New Password not alphanumeric");
        }
      }
      /* Change password attempted */
      else if($subcurpass){
        /* New Password error reporting */
        $field = "newpass";  //Use field name for new password
        $form->setError($field, "* New Password not entered");
      }

      /* Email error checking */
      $field = "email";  //Use field name for email
      if($subemail && strlen($subemail = trim($subemail)) > 0){
        /* Check if valid email address */
        $regex = "^[_+a-z0-9-]+(\.[_+a-z0-9-]+)*"
                ."@[a-z0-9-]+(\.[a-z0-9-]{1,})*"
                ."\.([a-z]{2,}){1}$";
        if(!eregi($regex,$subemail)){
            $form->setError($field, "* Email invalid");
        }
        $subemail = stripslashes($subemail);
      }

      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
        return false;  //Errors with form
      }

      /* Update password since there were no errors */
      if($subcurpass && $subnewpass){
        $database->updateUserField($this->username,"password",md5($subnewpass));
      }

      /* Change Email */
      if($subemail){
        $database->updateUserField($this->username,"email",$subemail);
      }

      /* Success! */
      return true;
  }

  /**
    * isAdmin - Returns true if currently logged in user is
    * an administrator, false otherwise.
    */
  function isAdmin(){
      return ($this->userlevel == ADMIN_LEVEL ||
              $this->username  == ADMIN_NAME);
  }

  /**
    * generateRandID - Generates a string made up of randomized
    * letters (lower and upper case) and digits and returns
    * the md5 hash of it to be used as a userid.
    */
  function generateRandID(){
      return md5($this->generateRandStr(16));
  }

  /**
    * generateRandStr - Generates a string made up of randomized
    * letters (lower and upper case) and digits, the length
    * is a specified parameter.
    */
  function generateRandStr($length){
      $randstr = "";
      for($i=0; $i<$length; $i++){
        $randnum = mt_rand(0,61);
        if($randnum < 10){
            $randstr .= chr($randnum+48);
        }else if($randnum < 36){
            $randstr .= chr($randnum+55);
        }else{
            $randstr .= chr($randnum+61);
        }
      }
      return $randstr;
  }
};


/**
 * Initialize session object - This must be initialized before
 * the form object because the form uses session variables,
 * which cannot be accessed unless the session has started.
 */
$session = new Session;

/* Initialize form object */
$form = new Form;

?>