echo after session

Question

I have the code below:

<?php
session_start();
echo "\n\n";
echo "inputAction.php started";

//echo "<br/><br/>";

$name = $_POST["theUser"];
$passw = $_POST["thePassword"];

if (!strcmp($name, "myPassw") && !(strcmp($passw, "1234")) )
{
    //echo "correct";
    $_SESSION['sessionUser']=$name;
    $_SESSION['sessionPassword']=$passw;
    header("location:a.php");

}
else
{
    //echo "wrong";
    header("Location: index.php");
}

?>

My first attempt here is to echo "inputAction.php started"; after session_start();

However, I found out that I got an error:

inputAction.php started
Warning: Cannot modify header information - headers already sent by (output started at /Library/WebServer/Documents/01032011/inputAction.php:4) in /Library/WebServer/Documents/01032011/inputAction.php on line 16

But I notice that this will be fine if I comment out the echo after session_start();

<?php
session_start();
//echo "\n\n";
//echo "inputAction.php started";

//echo "<br/><br/>";

$name = $_POST["theUser"];
$passw = $_POST["thePassword"];

if (!strcmp($name, "myPassw") && !(strcmp($passw, "1234")) )
{
    //echo "correct";
    $_SESSION['sessionUser']=$name;
    $_SESSION['sessionPassword']=$passw;
    header("location:a.php");

}
else
{
    //echo "wrong";
    header("Location: index.php");
}

?>

What happened? Can somebody explain why echo makes the error?
Does that mean that it's a rule not to use echo after session_start ?
Any other ways to print logs (alternative to echo ) that I can use after session_start ?

Answer 1

No, the rule is rather not to output anything before header . And if you take a closer look onto the error message, it says: “Cannot modify header information […] on line 16” because “output started at […]:4”.

The line where the output started does not need to be the first one with echo as PHP does also have an internal buffer that is not flushed with every echo call.

If you want to output something before header you need to buffer it using the output control . So just call ob_start before anything else and every output is buffered so that the HTTP header can be modified even if some output already happened:

<?php
ob_start();
session_start();
// …

Answer 2

You've already sent information to the browser with the \\n\\n , so the browser constructed a page with default headers, as it will do if you send it any text at all (even a single character).

The browser's thinking, "OK, this is just plaintext, so I'll make it into HTML the best I know how and output it." As it does this, headers are made, and the document body is created, so any more headers you want to send it are ignored until this process is restarted (with a refresh).

For this not to happen, don't send any information to the browser until you're ready for it to start constructing the page.

Object buffering is an intermediate-difficulty topic that will take a while to get right if you haven't done it before.

Answer 3

That warning is produced with calling the header() function. The header() function sets HTTP header for the response you are sending back. And HTTP header must be the first thing in the response. No other output can be displayed before them.

There are many solutions to this problem. One is to turn on output buffering , which will magically take care of this. The better solution is to structure your code so that you don't output anything before any calls to the header() (or session_start() function). If you would use some MVC framework (cakephp, symphony, zend, ...) you wouldn't even have to worry about it.

This exact problem has been dealt here numerous times (it's one of the most popular questions about PHP). Look at this search results .

Also invest some time in reading PHP's error messages. The error message you provided clearly states that the error was "thrown" in the header() line, and which line started the output.

Answer 4

Because you are using the header() function in your else statement, anytime your code goes in there, it tries to redirect your page. However, like Gumbo said, header() will throw an error if there is anything output to the browser before it is called.

Answer 5

If you want it to echo that and then redirect, so that the user can see it, you could do it with some good, old-fashioned HTML, and you would have control over how long it took to move to the next page.

session_start();
echo '<head><meta http-equiv="refresh" content="5;url=http://www.whatever.com/a.php"></head>';
echo "\n\n";
echo 'inputAction.php started';
etc.etc.etc.

But of course, you would still have to test the input to determine what url=, which means you'd either test twice or just put the echo in the ifs anyway. Of course, it doesn't matter where the initial echos are if using ob_start() because it will only be output when the script is finished running.

Also, you really shouldn't store passwords in the Session.