Help with PHP if / else statement

Question

On my site, forms are brought in via AJAX and checked against a sessionid. I know this is not optimal, but it's working for us. If the referrer doesn't have the session ID they are redirected back to "anotherpage". I need to allow some outside URL's access the form directly. we set the sessionid on the page with the link to the form.

Here is what we have now on the form page:

<?php
$code = $_GET['sessionid'];
if(strcmp( $code , 'XXXXX'  ) != 0) {
    header("Location: http://www.domain.com/anotherpage.php");
} 
?>

I need to allow some outside domains direct access to the form page and am having issues with this: (I'm putting it above the head tag on the form page)

<?php
    $code = $_GET['sessionid'];
    $referrer = $_SERVER['HTTP_REFERER'];

    if(strcmp( $code , 'XXXXX' ) !=0) {
        header("Location: http://www.domain.com/anotherpage.php");
    } else {
        if (preg_match("/site1.com/",$referrer)) {
            header('Location: http://www.domain.com/desiredpage.php');
        }
    }
?>

this still bounces me back to "anotherpage.php" any ideas?

********EDIT******* thx for the help, it works ad I requested. Now I see what I asked wasn't entirely correct. This appends the URL with =sessionid?=XXXXX. This isn't an issue on my site because I'm loading the content with .jquery .load so the URL doesn't change. I don't want the sessionid to be visible, and now it is. Can I either a) "trim" the url somehow or b) separate the two functions so they are exclusive?

Doesn't the else warrant another condition? Shouldn't that condition be evaluated before the 'no-go redirect', or should the inner condition of else be embedded within the first, along with the redirect? — Grant Thomas
– Grant Thomas, Commented Mar 9, 2011 at 18:32

amosrivera · Accepted Answer · 2011-03-09 18:29:35Z

3

if(strcmp( $code , 'XXXXX' ) !=0) {
    if (preg_match("/site1.com/",$referrer)) {
        header('Location: http://www.domain.com/desiredpage.php');
    } else {
        header("Location: http://www.domain.com/anotherpage.php");
    }
}

answered Mar 9, 2011 at 18:29

amosrivera

26.6k9 gold badges70 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dirty Bird Design Over a year ago

@amosrivera - is there any way to do this w/o showing the appended url "domain.com/desiredpage.php?sesionid=XXXXX" in the browser address bar? on my site it's all done via jQuery .ajax > .load specific div's so the url is hidden

amosrivera Over a year ago

you could have a third page that takes care of the redirects, there you would have the if statement domain.com/redirect.php?sessionid=XXXX, is that what you mean?

Dirty Bird Design Over a year ago

@amosrivera - yes I think so, a separate third page that I tell external sites to use as <a href="externalpagescript.php"> and that page only has the referrer check?

amosrivera Over a year ago

no, i see that what you don't want to be visible is the session id, in that case you will have to do something different, like setting a cookie

Dirty Bird Design Over a year ago

@amosrivera - I see. Ill have to figure that out then. I really appreciate all your help, you answered the first question exactly as I asked it.

horatio · Accepted Answer · 2011-03-09 18:29:56Z

1

As I read your post, you want anyone from the preg_match to get the desired page regardless of sessionID status, so you don't want to test sessionID first.

Start the if block with the preg_match test.

answered Mar 9, 2011 at 18:29

horatio

1,4368 silver badges7 bronze badges

1 Comment

Dirty Bird Design Over a year ago

pls see edited question, I also don't want session id to show in url when coming from preg_match. when coming from page in site, url doesn't change as im using jQuery .ajax to .load content

Aaron Hathaway · Accepted Answer · 2011-03-09 18:31:01Z

1

Your first if is checking to see if they don't have the $code and redirecting them. This will always be the case. You should probably check the $referrer first and then do the $code check.

answered Mar 9, 2011 at 18:31

Aaron Hathaway

4,3832 gold badges21 silver badges17 bronze badges

Comments

jcubic · Accepted Answer · 2011-03-09 18:31:57Z

1

Try reverse if with else

<?php
    $code = $_GET['sessionid'];
    $referrer = $_SERVER['HTTP_REFERER'];
    if (preg_match("/site1.com/", $referrer)) {
        header('Location: http://www.domain.com/desiredpage.php');
    } else if (strcmp( $code , 'XXXXX' ) != 0) {
        header("Location: http://www.domain.com/anotherpage.php");
    }
?>

answered Mar 9, 2011 at 18:31

jcubic

67.1k58 gold badges252 silver badges466 bronze badges

9 Comments

Dirty Bird Design Over a year ago

@jcubic - same answer above, and works. can PHP "trim" a url? Is there any way to do this w/o showing the appended url "domain.com/desiredpage.php?sesionid=XXXXX" in the browser address bar? on my site it's all done via jQuery .ajax > .load specific div's so the url is hidden

jcubic Over a year ago

try header('Location: http://www.domain.com/desiredpage.php?'); you can also use mod_rewrite in .htaccess file if you use apache.

Dirty Bird Design Over a year ago

using header('Location.....php?') didn't work. How would I use it in .htaccess? a 301 redirect to the page with an appended url? wouldn't that still show url?

jcubic Over a year ago

In .htaccess if you put ? in destination url it don't append query_string. RewriteCond %{QUERY_STRING} !="sessionid=xxxx" RewriteRule .* /desiredpage.php? [R=301,L]

Dirty Bird Design Over a year ago

@jcubic - sorry man, how would I make sure this only comes from the allowed domain? or do I do it in combination with the PHP on page?

|

ncuesta · Accepted Answer · 2011-03-09 18:31:57Z

0

If I'm not misunderstanding this, the problem is in the order in which you are checking things.

If you want to allow some referrers to access the site even if they don't have the session id, you have to check for that before checking for the session id. Otherwise, they will end up being treated just like everyone else.

You can either switch the order of the conditions (first check for the referrer and then check fo the session id) or check for the referrer inside the branch in which you already know the session id is not valid.

answered Mar 9, 2011 at 18:31

ncuesta

7604 silver badges12 bronze badges

Comments

Groovetrain · Accepted Answer · 2011-03-09 18:33:16Z

0

The issue could be in your regex, it should be:

if (preg_match("/site1\.com/",$referrer))

notice escaping the dot (.)

answered Mar 9, 2011 at 18:33

Groovetrain

3,32521 silver badges23 bronze badges

Collectives™ on Stack Overflow

Help with PHP if / else statement

6 Answers 6

5 Comments

1 Comment

Comments

9 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

5 Comments

1 Comment

Comments

9 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related