Question

In my web admin area I have using very simple logic:

session_start(); ob_start();
if(!isset($_SESSION['user'])){
    header("Location: login.php");
}
contents...
ob_end_flush();

Yes this is working perfect, redirect to login page. But the comic point is that I can see the content of index.php (that protected!!!) here
What is wrong?

Answer 1

Put an ob_end_clean and exit after the header call to prevent any further execution/output:

if (!isset($_SESSION['user'])) {
    header("Location: login.php");
    ob_end_clean();
    exit;
}