One could write script that does this in php:

if(login_failed()) {
  header('Location: /login.php');
}
print "The SSN of the person you inquired is $ssn";

One would reason that since the redirect happened, you don’t need to do anything else. But execution did not stop at the header function.

The HTTP response to the client will contain the following line “The SSN of the person you inquired is …”. You may not see this using firefox plugins but simple use telnet to see that it is actually the case. It is quite dangerous! How to fix it:

if(login_failed()) {
  header('Location: /login.php');
} else {
  print "The SSN of the person you inquired is $ssn";
}

or just to be safe you can exit the application.

if(login_failed()) {
  header('Location: /login.php');
  exit();
}

Personally I like the latter solution. It does what I want the app to do. Terminate all script executions. But, it’s not OO, so you can do a bit better than this.

function redirect_to($url) {
  header('Location: /login.php');
  exit();
}

and

if(login_failed()) {
  redirect_to('/login.php');
} else {
  print "The SSN of the person you inquired is $ssn";
}

Now we assume OO is being used through out and you wouldn’t have some other script following this unless it’s in some method.

This is not completely done. If you exit() before the session data is written you will be in trouble. So you have add session_commit (or session_write_close). My preferred way is the function below:

function redirect_to($url) {
  header('Location: /login.php');
  session_commit();
  exit();
}