This is just a public service announcement for all the inexperienced developers who are writing redirects in PHP by issuing a call to header(“Location: <new url>”) to do their redirect. I see the same mistake time over and over again, and just to try to make sure that people actually remember this:
A Call to Header (even with Location:) Does NOT Stop The Execution of the Current Application!
A simple example that illustrates this:
/* DO NOT COPY THIS EXAMPLE. */
if (empty($_SESSION['authed']))
{
header('Location: http://example.com/');
}
if (!empty($_POST['text']))
{
/* insert into database */
}
/* Do other admin stuff */
The problem here is that the developer does not stop script execution after issuing the redirect. While the result when testing this code will be as expected (a redirect happens when the user is not logged in and tries to access the link). There is however a gaping security hole here, hidden not in what’s in the file, but what’s missing. Since the developer does not terminate the execution of the script after doing the redirect, the script will continue to run and do whatever the user asks of it. If the user submits a POST request with data (by sending the request manually), the information will be inserted into the database, regardless of wether the user is logged in or not. The end result will still be a redirect, but the program will execute all regular execution paths based on the request.