Question

I am creating a login script in PHP and I am just wondering if it is safe to redirect a user who is not logged in? I am checking the session and if the user is not logged in I want to use something like:

session_start();
//check session
if (user is not logged in)
    header ("Location: login.php"); 
//content of confidential file

Can the user somehow prevent the redirection and see the content or will the script stop and redirect no matter what the users does? I want to perform this check on every confidential page I have.

Thanks to all, I will use:

session_start();
//check if user is logged in
if(!check)
{
      header ("Location: login.php");
      die("Please <a href=\"login.php\">log in</a>");
}
//print all the html stuff only logged it users should see

Thanks for all the help!
Nick

Answer 1

The user will be redirected before any of the data is rendered. Just to be sure, make sure you put that code before any HTML or displaying anything.