如何防止在标头重定向后执行 PHP 代码？

Question

I've written a block of code to determine whether a user is logged in and their session has not timed out. If they are not logged in or they have been inactive they get sent to the logout.php page which updates the DB and destroys the session, and then bumps them back to the login page.

The issue I have is, further down the page is code to carry out various activities when a user submits forms. Because the header() redirect is virtually the first bit of code on the page and I expect the server to work through the code from top to bottom, it boggles my mind a bit that if I hit submit on a form and get logged out because I have been inactive, when I log back in the changes I submitted are made. That should not happen.

Code:

//check if the userID has been set (is set at login)
if(isset($_SESSION['userID'])){
    //some code here to get variables from the DB
    //then check that the last recorded activity was not more than x minutes ago
    if(time() - $_SESSION['lastActivity'] < 1800){
        //update the $_SESSION['lastActivity'] variable
    } else {
        header('Location: logout.php'); //inactive, send to logout page
    }
} else {
    header('Location: logout.php'); //not logged in, send to logout page
}

if(isset some post variable){
    //update database
}

This last if statement should not run if I am not logged in or haven't refreshed the page in more than 30minutes, but it does. Can anyone help me with why, and how to prevent it? I mean I know I can wrap the entirety of subsequent code within the if(isset($_SESSION['userID'])) condition, but that seems cumbersome and surely the first code block should be dealing with users not properly logged in?

Thanks in advance

Answer 1

You should have exit; on the next line after the header();

Answer 2

header("Location: ..."); only sends a header back to the client, telling it where to go. It does not explicitly cancel the execution of the current script on the server.

You should always have exit; after any header("Location: ..."); if you do not wish the script to continue.