I have often wondered what is more secure, efficient and generally better?
If I have a login form, is it best to create a separate php file to handle the processing then redirect back to login page after it’s finished. Or is it best to do all the work on the same page?
Is there a general rule for this, or I’d it just personal preference?
What you choose is up to you. However, the Post-Redirect-Get pattern (PRG) is commonly used in PHP. With it, you post your form to a handling script which does not produce output. You may use the same handling script for many different forms, if you have a means to distinguish between them. After processing the POST, the handler script redirects back to the form page, or another page.
The PRG pattern helps to avoid problems with the browser back button and form resubmission.