Question

You know that if you want to redirect a user in PHP you can use the header function:

header('Location: http://smowhere.com');

It is also well known that it is a good practice to put also an exit; after the header call, to prevent execution of other php code. So my question is: could the code after the header-location call be effectively executed? In which cases? Can a malicious user be able to completely ignore the header('Location..') call? How?

Answer 1

could the code after the header-location call be effectively executed?

Yes, always. The header is only a line of data asking the browser to redirect. The rest of the page will still be served by PHP and can be looked at by the client by simply preventing the header command from executing.

That is easy enough to do with a command-line client like wget, for example, by simply telling it not to follow redirects.

Bottom line: If you don’t prevent it, PHP will send out the whole body even after a header call. That body is fully available to the recipient without any special hacking skills.