2014-12-22 4 views
0

내 애플리케이션에 대해 다음 로그인 스크립트를 실행 중입니다. 내 홈 서버에서 리디렉션은 성공적인 로그인 후에 항상 작동하여 사용자를 개인 페이지로 안내했습니다. 응용 프로그램을 GoDaddy로 업로드하면 더 이상 리디렉션되지 않습니다.PHP 헤더 위치가 HTML 파일로 리디렉션되지 않음

<?php 

    // First we execute our common code to connection to the database and start the session 
    require("common.php"); 

    // This variable will be used to re-display the user's username to them in the 
    // login form if they fail to enter the correct password. It is initialized here 
    // to an empty value, which will be shown if the user has not submitted the form. 
    $submitted_username = ''; 

    // This if statement checks to determine whether the login form has been submitted 
    // If it has, then the login code is run, otherwise the form is displayed 
    if(!empty($_POST)) 
    { 
     // This query retreives the user's information from the database using 
     // their username. 
     $query = " 
      SELECT 
       id, 
       username, 
       password, 
       salt, 
       email, 
       reg_type, 
       assoc 
      FROM users 
      WHERE 
       username = :username 
     "; 

     // The parameter values 
     $query_params = array(
      ':username' => $_POST['username'] 
     ); 

     try 
     { 
      // Execute the query against the database 
      $stmt = $db->prepare($query); 
      $result = $stmt->execute($query_params); 
     } 
     catch(PDOException $ex) 
     { 
      // Note: On a production website, you should not output $ex->getMessage(). 
      // It may provide an attacker with helpful information about your code. 
      die("Failed to run query: " . $ex->getMessage()); 
     } 

     // This variable tells us whether the user has successfully logged in or not. 
     // We initialize it to false, assuming they have not. 
     // If we determine that they have entered the right details, then we switch it to true. 
     $login_ok = false; 

     // Retrieve the user data from the database. If $row is false, then the username 
     // they entered is not registered. 
     $row = $stmt->fetch(); 
     if($row) 
     { 
      // Using the password submitted by the user and the salt stored in the database, 
      // we now check to see whether the passwords match by hashing the submitted password 
      // and comparing it to the hashed version already stored in the database. 
      $check_password = hash('sha256', $_POST['password'] . $row['salt']); 
      for($round = 0; $round < 65536; $round++) 
      { 
       $check_password = hash('sha256', $check_password . $row['salt']); 
      } 

      if($check_password === $row['password']) 
      { 
       // If they do, then we flip this to true 
       $login_ok = true; 
      } 
     } 

     // If the user logged in successfully, then we send them to the private members-only page 
     // Otherwise, we display a login failed message and show the login form again 
     if($login_ok) 
     { 
      // Here I am preparing to store the $row array into the $_SESSION by 
      // removing the salt and password values from it. Although $_SESSION is 
      // stored on the server-side, there is no reason to store sensitive values 
      // in it unless you have to. Thus, it is best practice to remove these 
      // sensitive values first. 
      unset($row['salt']); 
      unset($row['password']); 

      // This stores the user's data into the session at the index 'user'. 
      // We will check this index on the private members-only page to determine whether 
      // or not the user is logged in. We can also use it to retrieve 
      // the user's details. 
      $_SESSION['user'] = $row; 

      // Redirect the user to the private members-only page. 
      header('Location: ../private.html'); 
      die(); 
     } 
     else 
     { 
      // Tell the user they failed 
      print("Login Failed."); 

      // Show them their username again so all they have to do is enter a new 
      // password. The use of htmlentities prevents XSS attacks. You should 
      // always use htmlentities on user submitted values before displaying them 
      // to any users (including the user that submitted them). For more information: 
      // http://en.wikipedia.org/wiki/XSS_attack 
      $submitted_username = htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); 
     } 
    } 
?> 

헤더 명령을 작동시키는 방법에 대한 조언을 얻을 수 있습니까?

+1

사용하여 페이지를 리디렉션 & perfact입니다. – NoCode

+0

주제를 완전히 벗어 났지만 관련성이 있습니다. PHP에서 해시를 위해 내장 된 pbkdf2 함수를 사용하는 것이 좋습니다. 그 이후로 당신이하고있는 것과 거의 같기는하지만 안전하고 편리합니다. http://php.net/manual/en/function.hash-pbkdf2.php – NoCode

+0

여는'

답변

0

php.ini 문제 : output_buffering = On 이 (가) 열려있을 수 있습니다.

헤더를 제어하십시오.

if (!headers_sent()) { 
    header('Location: ../private.html'); 
    exit; 
}else{ 
    echo 'header problems'; 
} 
+0

Sory : 제 영어가 좋지 않습니다. –

+0

if ($ login_ok) current true? 제발 제어하십시오. –

0

코드는 당신이 또한 헤더() 함수를 호출하기 전에 스크립트가 모든 출력 (오류, 경고,주의 사항)를 생성되어 있지 않은지 확인 자바 스크립트

<script type="text/javascript"> 
window.location.href = url; or 
window.location = url; or 
location.replace(url); 
</script> 
관련 문제