CODEWITHSUNDEEP
phpsecurity
user3359695
user3359695

Reputation: 45

php page accessible only by passing through another php page

I am looking to develop a website containing stages. I want for example to pass by the stage 2 only when i click on the finish button in the page of stage 1 so the stage 2 page can't be accessible by its url or whatever only if the user pass by another page.

Is there a method to do this ??? i am a beginner in security so please try to help me, thanks in advance coders

Upvotes: 2

Views: 627

Answers (2)

prateekkathal
prateekkathal

Reputation: 3572

I think, this show work :)

Use can either redirect your user directly from index.php to open.php

header('Location : open.php');

Or, in open.php, put this

if($_SERVER['HTTP_REFERER'] == 'index.php page's full link') {
  //Do or Show whatever you want to show here
} else {
  // Tell the user that you are not authorized
}

If that doesn't work, echo $_SERVER['HTTP_REFERER'] and see what link it gives you. And put that link where specified above.

Cool? :)

Edit (As per the comments) --

Lets say you have a form in your form in stage1.php

<form method="post" action="">
<span class="error"><?php echo $error; ?></span>
Name: <input type="text" name="name"><br/>
Email: <input type="text" name="email"><br/>
<input type="submit" name="submit" value="Submit">
</form>

use this php in stage1.php 

if (isset($_POST['name'])||isset($_POST['email'])) {
    if (!empty($_POST["name"])||!empty($_POST["email"])) {
        $error = "Please fill in all the fields correctly";
    }
    else {
        $name = $_POST['name'];
        $email = $_POST['email'];
        //You can also save the above Variables Globally by $GLOBALS['name'] = $_POST['name'];
        //So that you can use the details when you reach the final stage
        header('Location : stage2 page's link');
    }   
}
?>

and in Page 2 lets say you have another form, then there also check

<?php
if(!empty($name)||!empty($email)) { 
//the above is check for global variables email and name are not empty - means stage 2 was filled properly

//Do things for the second page's form like you did for stage 1
} else {
header('Location : stage1 page's link');
//redirect back to stage 1. 
}
?>

Upvotes: 0

Shankar Narayana Damodaran
Shankar Narayana Damodaran

Reputation: 68486

Make use of sessions to develop this model.

index.php

<?php
@extract($_POST);
if(isset($sub))
{
session_start();
$_SESSION['authenticate']=true;
    header("location:test1.php");
    exit;
}
?>
<form action='' method="post">

    <input type="SUBMIT" name="sub" value="Finish" />

</form>

open.php

<?php
session_start();
if(!isset($_SESSION['authenticate']))
{
    echo "You are not allowed to access";
}
else { echo "You came from index.php ! so you are a valid user"; }
session_destroy(); //<-- I added this so you can test your example multiple times.

Upvotes: 2

Related Questions