Question

within my login code (index.php) there is a section for facebook login. it checks whether or not the user has been logged in. now i can’t use headers to redirect the user to a different page because it produces the error

Warning: Cannot modify header information - headers already sent by

(output started at
C:\xampp\htdocs\kite\index.php:81) in
C:\xampp\htdocs\kite\index.php on line
196

so as a result i’ve resorted to using to meta-refresh

    <?php 
                //if user is logged in already
                if ($user): ?>
                <?php 
                //redirect them to the user sonline page
echo '<META HTTP-EQUIV="Refresh" Content="1; URL=main.php">'; 
                //if user is not logged in
                else: ?>
                <input name="fblogin" type="button" value="Login with Facebook" class="fblogin" onclick="location.href='<?php echo $loginUrl; ?>'"/>
                <?php endif ?>

what are the advantages and disadvantages of this method?

thanking you in advance

---

all i have on line 81 is

<?php // include the hashing class  
require ("resources/phpass/PasswordHash.php"); 

Answer 1

In login and logout context, header() will stop the browser from caching the page, which stores some sensitive information of the user.

You need to send header BEFORE any of your HTML will be displayed.

There are some more reasons behind header(), to make it preferable to the developers. But in login context, I think that’s enough.