Php isset $_GET not working as expected

Question

I'm trying to pass $user_domain to login.php. I get the value from first_page.php from header();. In returning_user.php I set a variable $_SESSION['returning_user'] to let my program know what to do in login.php. If everything goes well, the user stays on login.php. If something goes wrong, the user is redirected to first_page.php and must resubmit form. The problem I'm facing right now is that the user is being returned to first_page.php when I include returning_user.php inside login.php. When I remove it, the user stays on login.php but it seems the code between the if() statement is not being executed. I don't know what I'm doing wrong. Any help would be greatly appreciated.

first_page.php

//rest of code above
if($stmt){
header("Location: returning_user.php?domain=".$domain."&key=".$key."");
exit;
}

returning_user.php

session_start();
if(isset($_GET['key'])  && isset($_GET['domain']) ){

//get domain variable
$user_domain = $_GET['domain'];

//put key variable in session
$_SESSION['user_domain'] = $user_domain;

//create a returning_user session
$_SESSION['returning_user']="TRUE";

//direct user to login page
header("location:../login.php");
exit;

}else{
 header("location : first_page.php");
 exit;
   }

login.php

 session_start();
 include 'returning_user.php';

    if(isset($_SESSION['returning_user']) && $_SESSION['returning_user']=="TRUE"){
    //do something amazing here
}

var_dump($_GET)

array(2) { ["domain"]=> string(10) "mydomain" ["key"]=> string(7) "7024158" } 

Answer 1

If domain contains a ?, it breaks the &key variable.

You should change your first_page.php to

if($stmt){
    header("Location: returning_user.php?domain=". urlencode($domain)."&key=".$key."");
}

Answer 2

BEFORE:

Your code have a problem, which I'll try to explain:

• You, the user, are on the first_page.php.
• From there you are redirected to returning_user.php. The GET values ("domain" and "key") are passed too.
• returning_user.php reads the GET values (which are now SET), writes them to session and redirects you to login.php (WITHOUT passing the GET values too). Note: Technically you are passing two GET values to a page (returning_user.php) in order to save them there in session. This step is in my opinion not needed; you could have saved them in session directly in the first_page.php.
• In login.php the page returning_user.php is included. It tries to read the GET values again. But, because the GET values are NOT ANYMORE SET, you are redirected to first_page.php.

Another problem is the one described by @MatsLindh.

AFTER:

So I gave some thoughts about what you want to achieve, and I came with the following solution:

• You, the user, are on the first_page.php.
• You complete a form and submit it.
• Upon submit, the values "domain", "key" and "returning_user" are written into session.
• Then you are redirected to login.php.
• In login.php a file named protector.php is included. protector.php checks if the session values "domain" and "key" are set. If not, a redirect to first_page.php takes place.
• If the validation of the session variables in protector.php is successful, then the further codes in login.php can be processed. Like: read the session variable "returning_user" and do something amazing there :-)

Notes:

• You can see protector.php as replacer for your returning_user.php.
• You can include protector.php in all pages which need to be "protected".
• I would have renamed first_page.php to dashboard.php.
• In first_page.php I implemented a form, in order to be able to display something on screen in case of a redirect from another page to first_page.php and to start the redirect to login.php upon clicking on a button, e.g. upon form submission.

Good luck!

first_page.php

<?php
session_start();

// Operations upon form submit.
if (isset($_POST['submitButton'])) {
    $stmt = TRUE;
    $domain = 'mydomain';
    $key = '7024158';

    if ($stmt) {
        $_SESSION['domain'] = $domain;
        $_SESSION['key'] = $key;
        $_SESSION['returning_user'] = 1; // Don't use 'TRUE'.

        header('Location: login.php');
        exit;
    }
}
?>
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8" />

        <title>Demo</title>

        <style type="text/css">
            .header, .section { padding: 10px; }
            .header { border-bottom: 1px solid #ccc; background-color: #eee; }
            .section div { padding-bottom: 10px; }
            .section button { padding: 10px; color: #fff; border: none; width: 200px; background-color: #269abc; }
        </style>
    </head>
    <body>

        <header class="header">
            <h3>
                Welcome! You are on the first page ;-)
            </h3>
        </header>

        <section class="section">
            <form action="" method="post">
                <div>
                    Here comes some form content...
                </div>
                <button type="submit" name="submitButton">
                    Submit
                </button>
            </form>
        </section>

    </body>
</html>

protector.php

<?php

session_start();

// Check domain and key.
if (!isset($_SESSION['domain']) || !isset($_SESSION['key'])) {
    header('Location: first_page.php');
    exit;
}

login.php

<?php

require_once 'protector.php';

echo 'Page validation successful.';
echo '<br/><br/>';

if (isset($_SESSION['returning_user']) && $_SESSION['returning_user']) {
    echo 'I will do something amazing here...';
}

Answer 3

When you do include 'returning_user.php'; in login.php, the code in returning_user.php runs. If you follow that code path from the top, you can see that regardless of the contents of the any parameters, the end result is a redirect - either to login.php a directory down (.. these paths seem weird, as that means that the login.php you've added is not the same login.php as you're redirecting the user to) or to first_user.php.

I'm not sure you actually wanted to do include 'returning_user.php'; - it seems you've based everything else on that page setting up a session and then redirecting the user to the destination, instead of having the file being included (and when it's being included like that, you're importing the variables into the current scope - no need for a session for something like that).

Answer 4

I see your frustration. For a start, you DO need to remove returning_user.php from Login.

Then, replace your code with this in login, with this:

session_start();

if(isset($_SESSION['returning_user'] == "TRUE")){
echo "Success!";
}

Also (and this is generally an unpopular opinion), to avoid using headers, which can cause other problems elsewhere, I much prefer to end my PHP tag, and place the following Javascript

 <script>location.replace("whatever.php");</script>

And then pick my PHP tag up immediately after.