PHP infinite redirects

Question

I'm writing a PHP time punch program using OOP.

But i keep getting infinite redirects, is there any way i can execute the function only once?

    public function validatetimetable($user_id)
    {
        $conn = $this->conn();
        $sql = "SELECT* FROM users WHERE id = '$user_id'";
        $result = mysqli_query($conn, $sql);

        while($row = mysqli_fetch_assoc($result)):
        $status = $row['status'];
        endwhile;   

        if($status == 1)
        {
            header("Location:home.php");
        }
        elseif($status == 2)
        {
            header("Location:index.php");
        }

    }

Hello try to use a return statement on you two header locations — Jud3v, Apr 18 '20 at 22:51
Try to Add return statement to your two header location, hope this help — Jud3v, Apr 18 '20 at 22:52
Where do you call this function? Try to add this information to the question — Jasper B, Apr 18 '20 at 22:54
i call this function on the top of every page. `$validatetimetable = new DBops(); $validatetimetable->validatetimetable($_SESSION['user_id']);` — Matthew Almeida, Apr 18 '20 at 22:55
**WARNING**: When using `mysqli` you should be using [parameterized queries](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and [`bind_param`](http://php.net/manual/en/mysqli-stmt.bind-param.php) to add any data to your query. **DO NOT** use string interpolation or concatenation to accomplish this because you have created a severe [SQL injection bug](http://bobby-tables.com/). **NEVER** put `$_POST`, `$_GET` or data *of any kind* directly into a query, it can be very harmful if someone seeks to exploit your mistake. — tadman, Apr 18 '20 at 23:55
If you're just getting started with PHP and want to build applications, I'd strongly recommend looking at various [development frameworks](https://www.cloudways.com/blog/best-php-frameworks/) to see if you can find one that fits your style and needs. They come in various flavors from lightweight like [Fat-Free Framework](https://fatfreeframework.com/) to far more comprehensive like [Laravel](http://laravel.com/). These give you concrete examples to work from and guidance on how to write your code and organize your project's files. — tadman, Apr 18 '20 at 23:55
can't you just use prepared statements and mysqli_real_escape_string for this? — Matthew Almeida, Apr 19 '20 at 00:24

score 0 · Answer 1 · answered Apr 18 '20 at 23:00

0

Ok, so i fixed it by declaring the $status a static variable and returned it on each header.

    {
        $conn = $this->conn();
        $sql = "SELECT* FROM users WHERE id = '$user_id'";
        $result = mysqli_query($conn, $sql);

        while($row = mysqli_fetch_assoc($result)):
        $status = $row['status'];
        endwhile;   

        static $status;

        if($status == 1)
        {
            header("Location:home.php");
            return $status;
        }
        elseif($status == 2)
        {
            header("Location:index.php");
            return $status;
        }

    }

answered Apr 18 '20 at 23:00

Matthew Almeida

23
5

1

this code is still vulnerable to **sql injection** so switch to **prepared statements** with parameters see https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – nbk Apr 18 '20 at 23:02
hmm, i see, thank you very much! i will be changing up my project/ – Matthew Almeida Apr 18 '20 at 23:06

PHP infinite redirects

1 Answers1