Is it possible to insert php code into a ' header("Location: example.php") ' command?

Question

I have the following command in a block of php code: header("Location: clivesclassiclounge_blogtest_single.php?loginsuccess");

I would like to modify the header to query a database – something like: header("Location: clivesclassiclounge_blogtest_single.php?post=<?php echo $row['id']?>loginsuccess");

My coding program/text editor detects an error when I try to set this up (also it just feels sloppy). I feel like I am coming at this problem the wrong way at would really appreciate any advice.

Thanks,

Full code block:

function getLogin ($conn) {
    if (isset($_POST['loginSubmit'])) {
    $uid= mysqli_real_escape_string($conn, $_POST['uid']);
    $pwd= mysqli_real_escape_string($conn, $_POST['pwd']);

    $sql = "SELECT * FROM user WHERE uid='$uid' AND pwd='$pwd'";
    $result = mysqli_query($conn, $sql);
    if (mysqli_num_rows($result) > 0) {
        if ($row = $result->fetch_assoc()) {
            $_SESSION['id'] = $row['id'];
            $_SESSION['uid'] = $row['uid'];
            header("Location: clivesclassiclounge_blogtest_single.php?loginsuccess");
            exit();
        }
    } else {
        header("Location: clivesclassiclounge_blogtest_single.php?loginfailed");
        exit();
        }
    }
}

I smell a dangerous idea lurking here... be aware that the user can *change* that `id` in the URL to anything they want it to be, which could have serious security implications. There is no obvious reason why you need this -- you're already storing it in `$_SESSION`. — Michael - sqlbot, Jan 21 '17 at 14:43

score 1 · Accepted Answer · edited May 23 '17 at 10:29

You would want to concatenate the URL string rather than echo e.g

if (mysqli_num_rows($result) > 0) {
    if ($row = $result->fetch_assoc()) {
        $_SESSION['id'] = $row['id'];
        $_SESSION['uid'] = $row['uid'];
        header("Location: clivesclassiclounge_blogtest_single.php?" . $row['id'] . "loginsuccess");
        exit();
    }
} else {
    header("Location: clivesclassiclounge_blogtest_single.php?loginfailed");
    exit();
    }
}

PHP String Operators http://php.net/manual/en/language.operators.string.php

Joining Two Strings Together How to combine two strings together in PHP?

Is it possible to insert php code into a ' header("Location: example.php") ' command?

1 Answers1