Question

I know the code is pretty long…but I hope the solution I’m looking for is simple and quick. So I have a session working here on my order form. I have two forms echoed depending if the person is logged in. First if statement is if the user is logged in, it does all that stuff (I know the code is not perfect but it works for me). The question:
How can I redirect the user to their account after placing the order? I tried the header function before the }else{…didn’t work, took me right to the account page. I couldn’t find the code online because their forms were all inside html, not inside php, so the header didn’t work. Any advice???

<?php

    $memberOrder = "";
    $nonmemberOrder = "";

if(isset($_SESSION['id'])){

    include_once "connect_to_mysql.php";

    echo '<script type="text/javascript">

    function validate_form ( ) { 
    var numbers = /^[0-9]+$/;
    valid = true;

    if ( document.memberOrder.memberNumber.value == "" ) { 
    alert ( "Membership number must be entered." ); 
    valid = false;
    }
    if ( document.memberOrder.memberNumber.value.match(numbers)){
        valid = true;
    }else{
        alert ( "You must only have numbers entered as Membership Number.");
        valid = false;
    }
    if ( document.memberOrder.payment.value == "" ) { 
    alert ( "You must select a payment method." ); 
    valid = false;
    }
    if ( document.memberOrder.orderLinks.value == "" ) { 
    alert ( "You must insert a link to your order." ); 
    valid = false;
    }
    if ( document.memberOrder.size.value == "" ) { 
    alert ( "Size must not be blank." ); 
    valid = false;
    }
    if ( document.memberOrder.cost.value == "" ) { 
    alert ( "Cost must not be blank." ); 
    valid = false;
    }
    if ( document.memberOrder.cost.value.match(numbers)){
        valid = true;
    }else{
        alert ( "You must only have numbers entered as your item cost.");
        valid = false;
    }
    if (!document.memberOrder.checkbox.checked){
        alert ( "You must agree to terms before placing your order.");
        valid = false;
    }
    return valid;
    }
    </script>';

    $memberNumber = preg_replace("[^0-9]", "", $_POST['memberNumber']);
    $memberNumber = stripslashes($_POST['memberNumber']);
    $size = preg_replace("[^a-zA-Z]", "", $_POST['size']);
    $cost = preg_replace("[^0-9]", "", $_POST['cost']);
    $cost = stripslashes($_POST['cost']);
    $cost = strip_tags($cost);
    $color = preg_replace("[^a-zA-Z]", "", $_POST['color']);
    $color = stripslashes($_POST['color']);
    $color = strip_tags($color);
    $payment = $_POST['payment'];
    $orderLinks = $_POST['orderLinks'];

    $sql = mysql_query("INSERT INTO memberOrders (memberNumber, orderLinks, cost) VALUES 
                        ('$memberNumber', '$orderLinks', '$cost')") or die (mysql_error());

    $memberOrder = '<form action="order.php" method="post" name="memberOrder" id="memberOrder" onsubmit="return validate_form ( );">
                    <table cellpadding="10" width="500px">
                        <tr>
                            <td><div align="left">Membership Number</div></td>
                            <td><input type="text" name="memberNumber" id="memberNumber"  /></td>
                        </tr>
                        <tr>
                            <td><div align="left">Payment Type</div></td>
                            <td><input type="radio" name="payment" value="Bank Transfer" />Bank Transfer (recommended)<br/>
                                <input type="radio" name="payment" value="PayPal" />PayPal (additional 3% commission)<br/>
                                <input type="radio" name="payment" value="Western Union" />Western Union<br/>
                                <input type="radio" name="payment" value="MoneyGram" />MoneyGram<br/>
                            </td>
                        </tr>
                        <tr>
                            <td><div align="left">Link To Your Order</div></td>
                            <td><textarea rows="5" cols="20" name="orderLinks"  ></textarea></td>
                        </tr>
                        <tr>
                            <td><div align="left">Size</div></td>
                            <td><input style="width:50px" type="text" size="25px" name="size"  /></td>
                        </tr>
                        <tr>
                            <td><div align="left">Color</div></td>
                            <td><input type="text" size="25px" name="color"  /></td>
                        </tr>
                        <tr>
                            <td><div align="left">Cost of Your Item</div></td>
                            <td><input style="width:50px" type="text" name="cost"  /></td>
                        </tr>
                        <tr>
                            <td><div align="left">Order Agreement</div></td>
                            <td><input type="checkbox" name="checkbox" checked="checked" value="check" /><a href="#" id="agreement">View Order Agreement</a></td>
                        </tr>
                        <tr>
                            <td>&nbsp;</td>
                            <td><input type="submit" name="submit" value="Place Order!" /></td>
                        </tr>
                        </table>
</form>';
    echo $memberOrder;

    // Start assembly of Email Member the activation link
    $to = "[e-mail]";
    // Change this to your site admin email
    $from = "$memberNumber";
    $subject = "Member Order Placed";
    //Begin HTML Email Message where you need to change the activation URL inside
    $message = '<html>
    <body bgcolor="#FFFFFF">
    Member Number:  '.$memberNumber.' <br/><br/>
    Payment Type:  '.$payment.' <br/><br/>
    Order Links:  '.$orderLinks.' <br/><br/>
    Size:  '.$size.' <br/><br/>
    Color: '.$color.' <br/><br/>
    Order Cost: '.$cost.' <br/><br/>
    </body>
    </html>';
    // end of message
    $headers = "From: $from\r\n";
    $headers .= "Content-type: text/html\r\n";
    $to = "$to";
    // Finally send the activation email to the member
    mail($to, $subject, $message, $headers);


}else{

Answer 1

You cannot write anything to the browser and expect the header function to work. In order to set headers, the response body must be empty.

So I suggest to do something like:

if(isset($_POST['submit'])){
    // do the INSERT and whatnot
    // when finished call the header function
    header("Location: my_custom_page.php");
}
else{
    // output the form, javascript and what you need
}

So the first time the page loads, it will go in the else statement, because you have no POST data. This will print out the form and validation JavaScript. When the form gets submitted, the request lands in the if, and the order is placed, and then the client is redirected.

Again, in the if statement, you are not allowed to make any echos. A very bad alternative to this, would be to echo a small javascript that does the redirect (I don’t recommend this. ever):

<script>window.location.href = 'my_custom_page.php';</script>