Question

I know this is a very common question, but I could not find the answer

I’v a post.php, that submit a post form to controller.php
When it goes right, in controller it does:

header("Location: ./post?ok=1");

the post is actually inserted, and it goes through the line above,
but the url in the browser seems never changed, and at the end there is not the ok param,

I could use session variable to store such a success/failure param, but this way should be working

post.php:

<form action="controller" method="post">
    <input name="test" value='test' type="text" />
    <input type="submit" value="post"  />
</form>

controller.php:

<?php
    header("Location: ./post?ok=1");
?>

Edit 1:

header("Refresh:1;url=http://localhost/test/post?ok=1"); //doesn't work better

Edit 2:

in post.php top I’ve put

debug("post l ".count($_POST));
debug("get l ".count($_GET));

they show 0’s before submit, and 0’s after also

edit3: it works

was blocked by:

if ($success){
    header("Location: ./post?ok=1");
}
header("Location: ./post"); 

that should be:

if ($success){
    header("Location: ./post?ok=1");
} else {
    header("Location: ./post");
} 

thx all

Answer 1

First of all you should not use $_SERVER['HTTP_REFERER'] this is unsafe. Also it is possible that the client won’t send this header anyway. Right now I don’t know how but I’m sure that this could be used to highjack your site for something evil.

Better you should know where the form data came from and redirect the user there back.

By the way your redirect maybe don’t work like expected because the url already contain a questionmark. So you have to add more parameters with a & sign.

For the redirect I would suggest the HTTP 302 Found response status. But you have to be sure that nothing other is send out before. There must be no HTML output or empty lines before this following header line:

header("Location: http://".$_SERVER['HTTP_HOST']."/your/source.form", true, 302);