what is the correct/nice way to exit php CGI script running on aweb server?

**steve** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running

"Alex Hunsley" wrote:[color=blue]
> I’m making a web site that does login authentication.
> It all works fine, but I have a question about
> ’correctness’.. .
>
> Certain php scripts on the site should only run in the user has[/color]
logged[color=blue]
>
> on. So, the ’private’ scripts in question all includes the
> following php
> script:
>
> <?
> // has user authenticated?
> if (! $logged_in) {
> $newPath=’login .php’;
>
> echo "<html><head><m eta http-equiv=\"REFRESH \"
> content=\"3;
> url=$newPath\"> </head>";
>
> echo "<body>You can’t access this page without
> logging
> in!<p>Redirecti ng to the <a href=\"$newPath \">login
> page</a> in 3
> seconds.</body></html>";
>
> }
> // exit php so that no more content gets output!
> exit(0);
>
> ?>
>
> As you can see, if the user is not logged on, we output an http
> refresh
> to redirect the users browser to the login screen. It works fine,[/color]
but[color=blue]
> my
> main question is about the trick of calling exit(0) at the end,[/color]
which[color=blue]
> is
> required to stop the php script that includes the above code from[/color]
[color=blue]
> outputting any of its content (which is ’secret’ from
> unauthenticated
> users.)
> Is calling exit(0) ok to this end? Is it considered a dirty hacky[/color]
way[color=blue]
> of
> doing it? It does the job, but I’m just wondering if there is a
> nicer
> way of doing it I should be using.
>
> thanks
> alex[/color]

I believe the content produced to that point would still be output,
unless you cache the content (see ob_start, ob_get_content, etc. in
the manual).

But why wait 3 seconds? You could simply redirect to
"login.php?msg= 1" and if login.php has a $_GET[’msg’ ==1 then print
the message that they have to login first, and following it show the
normal login boxes.

--
http://www.dbForumz.com/ This article was posted by author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.dbForumz.com/PHP-correct-...ict133077.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.dbForumz.com/eform.php?p=444480

**Gordon Burditt** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running on aweb server?

>As you can see, if the user is not logged on, we output an http refresh[color=blue]
>to redirect the users browser to the login screen. It works fine, but my
>main question is about the trick of calling exit(0) at the end, which is
> required to stop the php script that includes the above code from
>outputting any of its content (which is 'secret' from unauthenticated
>users.)
>Is calling exit(0) ok to this end? Is it considered a dirty hacky way of
>doing it? It does the job, but I'm just wondering if there is a nicer
>way of doing it I should be using.[/color]

From the point of view of structured programming, it might be
better to do:

<?php
if (! $logged_in) {
... output a redirect page ...
} else {
... output the content ...
}
?>

However, there is a risk that if someone adds stuff on the end,
they might put it after the last brace, and output it to the
unauthorized users also.

Gordon L. Burditt

**Michael Austin** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running ona web server?

Gordon Burditt wrote:
[color=blue][color=green]
>>As you can see, if the user is not logged on, we output an http refresh
>>to redirect the users browser to the login screen. It works fine, but my
>>main question is about the trick of calling exit(0) at the end, which is
>> required to stop the php script that includes the above code from
>>outputting any of its content (which is 'secret' from unauthenticated
>>users.)
>>Is calling exit(0) ok to this end? Is it considered a dirty hacky way of
>>doing it? It does the job, but I'm just wondering if there is a nicer
>>way of doing it I should be using.[/color]
>
>
> From the point of view of structured programming, it might be
> better to do:
>
> <?php
> if (! $logged_in) {
> ... output a redirect page ...
> } else {
> ... output the content ...
> }
> ?>
>
> However, there is a risk that if someone adds stuff on the end,
> they might put it after the last brace, and output it to the
> unauthorized users also.
>
> Gordon L. Burditt[/color]

I would not pass logged_in as a plain text variable, make it a session id or
some other unique, per user and verifiable piece of data. if it is a simple
Y/N/1/0 then all I have to do is add that to a URL and I am in.

--
Michael Austin.
Consultant - Available.
Donations welcomed. Http://www.firstdbasource.com/donations.html
:)

**Alex Hunsley** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running

steve wrote:[color=blue]
> "Alex Hunsley" wrote:[color=green]
> > I’m making a web site that does login authentication.
> > It all works fine, but I have a question about
> > ’correctness’.. .
> >
> > Certain php scripts on the site should only run in the user has[/color]
> logged[color=green]
> >
> > on. So, the ’private’ scripts in question all includes the
> > following php
> > script:
> >
> > <?
> > // has user authenticated?
> > if (! $logged_in) {
> > $newPath=’login .php’;
> >
> > echo "<html><head><m eta http-equiv=\"REFRESH \"
> > content=\"3;
> > url=$newPath\"> </head>";
> >
> > echo "<body>You can’t access this page without
> > logging
> > in!<p>Redirecti ng to the <a href=\"$newPath \">login
> > page</a> in 3
> > seconds.</body></html>";
> >
> > }
> > // exit php so that no more content gets output!
> > exit(0);
> >
> > ?>
> >
> > As you can see, if the user is not logged on, we output an http
> > refresh
> > to redirect the users browser to the login screen. It works fine,[/color]
> but[color=green]
> > my
> > main question is about the trick of calling exit(0) at the end,[/color]
> which[color=green]
> > is
> > required to stop the php script that includes the above code from[/color]
>[color=green]
> > outputting any of its content (which is ’secret’ from
> > unauthenticated
> > users.)
> > Is calling exit(0) ok to this end? Is it considered a dirty hacky[/color]
> way[color=green]
> > of
> > doing it? It does the job, but I’m just wondering if there is a
> > nicer
> > way of doing it I should be using.
> >
> > thanks
> > alex[/color]
>
> I believe the content produced to that point would still be output,
> unless you cache the content (see ob_start, ob_get_content, etc. in
> the manual).[/color]

Yup, it does get output.[color=blue]
>
> But why wait 3 seconds? You could simply redirect to
> "login.php?msg= 1" and if login.php has a $_GET[’msg’ ==1 then print
> the message that they have to login first, and following it show the
> normal login boxes.[/color]

This is actually what my code already does, but I simplified the code I
outpout! The login form also has a hidden form value that holds the
original URL, and if the user logs in successfully they are sent on back
to the original page..
alex

**Alex Hunsley** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running ona web server?

Michael Austin wrote:
[color=blue]
> Gordon Burditt wrote:
>[color=green][color=darkred]
>>> As you can see, if the user is not logged on, we output an http
>>> refresh to redirect the users browser to the login screen. It works
>>> fine, but my main question is about the trick of calling exit(0) at
>>> the end, which is required to stop the php script that includes the
>>> above code from outputting any of its content (which is 'secret' from
>>> unauthenticated users.)
>>> Is calling exit(0) ok to this end? Is it considered a dirty hacky way
>>> of doing it? It does the job, but I'm just wondering if there is a
>>> nicer way of doing it I should be using.[/color]
>>
>>
>>
>> From the point of view of structured programming, it might be
>> better to do:
>>
>> <?php
>> if (! $logged_in) {
>> ... output a redirect page ...
>> } else {
>> ... output the content ...
>> }
>> ?>
>>
>> However, there is a risk that if someone adds stuff on the end,
>> they might put it after the last brace, and output it to the
>> unauthorized users also.
>>
>> Gordon L. Burditt[/color][/color]

This was the original approach. However, since my checking code that I
originally posted is in another file which gets included at the top of
each script that is 'private', the if { } else { } part can't really be
done in that situation.
[color=blue]
>
>
> I would not pass logged_in as a plain text variable, make it a session
> id or some other unique, per user and verifiable piece of data. if it
> is a simple Y/N/1/0 then all I have to do is add that to a URL and I am in.[/color]

logged_in isn't a passed in cgi variable, it is set according to the
user having a cookie already set, so they can't just mung the url to cheat!

alex

**Aidan** · Jul 17 '05, 07:28 AM

Re: what is the correct/nice way to exit php CGI script running on a web server?

>[color=blue]
> logged_in isn't a passed in cgi variable, it is set according to the
> user having a cookie already set, so they can't just mung the url to[/color]
cheat!

Additionally, an attacker would need to know the varible names used in the
script to be able to pass them as arguments in the URL.
[color=blue]
>
> alex
>
>[/color]

**Alex Hunsley** · Jul 17 '05, 07:29 AM

Re: what is the correct/nice way to exit php CGI script running ona web server?

Aidan wrote:[color=blue][color=green]
>>logged_in isn't a passed in cgi variable, it is set according to the
>>user having a cookie already set, so they can't just mung the url to[/color]
>
> cheat!
>
> Additionally, an attacker would need to know the varible names used in the
> script to be able to pass them as arguments in the URL.
>[/color]

Yup! This variable $logged_in is never passed to the client side, so
they have no way of knowing it is there or is checked..
And even when I *do* try to pass in a cgi var, e.g. ?logged_in=true , it
doesn't work, since the script overwrites the value with its own value
based on cookies being present and authentic.

alex

what is the correct/nice way to exit php CGI script running on aweb server?

what is the correct/nice way to exit php CGI script running on aweb server?

Comment

Comment

Comment

Comment

Comment

Comment

Comment