Question

I’m writing a custom CMS/login system that is using php/mysql, and I’m trying to develop proper security for the pages that require a login. This is the format I’m currently using, which seems to work perfectly fine, but I want to implement a cleaner solution:

<?php
    $allowed = false;

    // logic here to determine if the user should be able to view this page; set allowed if so

    if ($allowed){

        // show secured data

    } else {
        header( 'Location: login.php');
        exit();
    }
?>

I want to simplify it to this:

<?php
    $allowed = false;

    // logic here to determine if the user should be able to view this page; set allowed if so

    if (!$allowed){
        header( 'Location: login.php');
        exit();
    } 

    // show secured data

?>

Would it be just as secure this way?

Answer 1

Yes. Absolutely fine! Perfect!

So long as you don’t by mistake set $allowed to true when it should be false.