How can I prevent users from logging in and then typing a url and carry the session to that url?

Question

I am creating a website where you can login to a free version of a specific area, and you pay to get to a paid version of that specific area, but when I login into the free version of that area and if I type in the url of the paid version, it takes me there, how can I make sure that when the url is typed in it redirects the user.

The index.php for the free version is the same for the paid version.

Here is the code for the free version:

index.php:

login for free version:




prepare($query);
    $statement->execute(
        array(
            ':username' => $_POST["username"]
        )
    );
    $count = $statement->rowCount();
    if($count > 0)
    {
        $result = $statement->fetchAll();
        foreach($result as $row)
        {
            if(password_verify($_POST['password'], $row['password']))
            {
                $_SESSION['user_id'] = $row['user_id'];
                $_SESSION['username'] = $row['username'];
                header('location: page.php');
            }
            else
            {
                $message = 'Wrong Password';
            }
        }
    }
    else
    {
        $message = 'Wrong Username';
    }
}


?>

 
    
        Connect Kitty
        
        
          
    
     
     
 



   
        
    
        
    
        
            
                
                        

                
                
                    
                        
                        
                            
                        
                        

                        
                            
                        
                        

                        
                            
                        
                        


                    
                
            
            
Don't have an account? Register
        

Terms, Data Policy, and Cookies Policy

and here is the login for the paid version:

login.php:



prepare($query);
    $statement->execute(
        array(
            ':username' => $_POST["username"]
        )
    );
    $count = $statement->rowCount();
    if($count > 0)
    {
        $result = $statement->fetchAll();
        foreach($result as $row)
        {
            if(password_verify($_POST['password'], $row['password']))
            {
                $_SESSION['user_id'] = $row['user_id'];
                $_SESSION['username'] = $row['username'];
                header('location: index.php');
            }
            else
            {
                $message = 'Wrong Password';
            }
        }
    }
    else
    {
        $message = 'You are not a subscriber, to become a subscriber, return here';
    }

}


?>

 
    
        Connect Kitty
        
        
         
    
     
   
        
    
        
    
        
            
                
                        

                
                
                    
                        
                        
                            
                        
                        

                        
                            
                        
                        

                        
                            
                        
                        


                    
                
            
            
Don't have an account? Register
        

Terms, Data Policy, and Cookies Policy

I have tried using this:

Which would trigger a redirection if the actual login form was not submitted to enter the page, but when I use this line of code when I login it does not direct me to the index.php page.

How can I prevent users from logging in and then typing a url and carry the session to that url?

Answers (1)

Related Questions