Question

I have a question about header('location: ----.php'). Is it safe for an ADMIN to use this function to restrict USER access for some pages? For example if a user is not an ADMIN can I use this function to prevent the user from seeing some pages? Is this a good way to secure some pages from unauthorized access? If not can someone give me a suggestion for secure restriction?

For example I’m using this for restriction:

$id = $_SESSION['id'];
$queryget = mysql_query("SELECT * FROM users WHERE id='$id'"); 
$row_12 = mysql_fetch_assoc($queryget);
$admin = $row_12['admin_id'];
$ruka = $row_12['rukovoditelj'];


if($row_12['admin_id'] > 1)
{
    header('Location: dosjei.php');
}

Answer 1

It’s safe assuming you stop the execution of the script after (with the exit; order for instance).

header("Location: dosjei.php");
exit;

Of course you need to do the verification at the beginning of the script before to write on the page some data you need to hide to unauthorized users.