Question

I am trying to create a login page for some sites that I manage. So far it worked easy enough by having a login page which connects to a database which told the page where to redirect them.

I also have an .htaccess that rewrites the URL to pass through an authorisation page that just checks if a session has been started then pushes them through.

The problem I have is that when an admin logs in to the admin page it isn’t parsing the php and when I go ‘view source’ I can see all the code… how do I get it to parse the php?

.htaccess

Options +FollowSymLinks  
RewriteEngine on  
RewriteRule ^(.*)$ ../authorise.php?file=$1 [NC]

authorise.php

session_name('TSiteStats');  
session_start();  
if (isset($_SESSION['user_id']))  readfile ($_SESSION['redirect'] . '/' . $_REQUEST['file']);  
else header("Location: ../login.php");

Answer 1

Just to be sure.

Does you file use the <?php and ?> tags. These tag will tell Apache to load the PHP code to be executed.

Also, does the script can be executed (has the authorization to be executed by Apache).

Last thing, your code is using readfile which output the content of the file and not execute this one. Are you sure you want to readfile and not include it?