Question

I need to redirect users if I don’t want them to be able to access a certain page. How reliable is header('Location: ../acc/login.php'); for example? Can browsers ignore 302 errors, and is this the right way? Thanks in advance!

Answer 1

It depends a lot what you’re trying to do. Technically spoken, header() is somewhat reliable. Only somewhat, because many PHP users have problems with it and to not get it to work.

PHP will prevent it from working if output has been already send to the browser. A drastic example:

<protected page content here>
<?php
    header('Location: login-first.php');
    exit();
?>

This would not work at all. You would eventually see even an error message with a warning.

Headers – by design – need to be send out before any other content (response body). They can not be send any longer if the response body has already started and PHP can’t help you then in that case.

However, if you send headers before the response body, that function will work. Also the risk obviously to mess something up is not that drastic any longer, too:

<?php
    header('Location: login-first.php');
    exit();
?>
<protected page content here>