Is $_SERVER[HTTP_HOST] the cause of redirect issues?

Question

I have enabled vanity urls (user.domain.com). When a session expires or somebody clears the cookies, the page would get redirected to user.domain.com which has the login page. So, on all pages i am using the following code:

 if(!isset($_SESSION['user_name'])) { header("Location: http://$_SERVER[HTTP_HOST]");}

2 of of 10 times i get a redirect error saying that the page is redirecting too many times.

Could this be the reason? And if it is what can i do to redirect in a way that won't cause such issues.

Thanks.

Login code:

<?php

 session_start(); 



  // Process the POST variables
  $username = $_SESSION["user_name"];
   //$password = $_POST["password"];


  // Set up the session variables
  $_SESSION["user_name"] = $username;

   $ugData = $_REQUEST['sub_name'];

 if($_POST){
  $_SESSION['user_name']=$_POST["user_name"];
  $_SESSION['password']=$_POST["password"];  
   }



   $secret = $info['password'];

//Checks if there is a login cookie

   if(isset($_COOKIE['ID_my_site']))


   //if there is, it logs you in and directes you to the members page

           { 
      $username = $_COOKIE['ID_my_site']; 

      $pass = $_COOKIE['Key_my_site'];

    $check = mysql_query("SELECT user_name, password FROM accounts WHERE user_name = '$username' and sub_name='$ugData'")or die(mysql_error());

while($info = mysql_fetch_array( $check )) 



    {

        if (@ $info['password'] != $pass) 
        {

                    }

    else

        {

        header("Location: home.php");



        }

    }

        }


       //if the login form is submitted 

       if (isset($_POST['submit'])) { // if form has been submitted



           // makes sure they filled it in

        if(!$_POST['user_name'] | !$_POST['password']) {

          die('You did not fill in a required field.');

            }

            // checks it against the database



          if (!get_magic_quotes_gpc()) {

    $_POST['user_name'] = addslashes($_POST['user_name']);


              }

$check = mysql_query("SELECT user_name,password FROM accounts 
    WHERE user_name = '".$_POST['user_name']."' 
    and sub_name='".$ugData."'")or die(mysql_error());



      //Gives error if user dosen't exist

      $check2 = mysql_num_rows($check);

         if ($check2 == 0) {

     die('That user does not exist in our database. 
           <a href=add.php>Click Here to Register</a>');

            }

           while($info = mysql_fetch_array( $check ))   

           {

        $_POST['password'] = md5($_POST['password']);
        $_POST['password'] = $_POST['password'];



      //gives error if the password is wrong



         if (@ $_POST['password'] != $info['password']) {

        die('Incorrect password, please try again');


                }

             else 

          { 


           // if login is ok then we add a cookie 

             $_POST['user_name'] = stripslashes($_POST['user_name']); 

              $hour = time() + 3600; 

                 setcookie(ID_my_site, $_POST['user_name'], $hour); 

                setcookie(Key_my_site, $_POST['password'], $hour);   



             //then redirect them to the members area 

        header("Location: home.php"); 

           } 

            } 

           } 

      else 

           {     





          ?> 

Answer 1

Assuming that redirecting to http://yourserver/ means http://yourserver/index.php , then you should change the if to read

if(!isset($_SESSION['user_name']) && $_SERVER['PHP_SELF'] != '/index.php')
{
    header("Location: http://$_SERVER[HTTP_HOST]");
}

This will avoid endless redirects.

Answer 2

The header("Location: http://{$_SERVER['HTTP_HOST']}"); isn't the problem per-say.

However, if you do have that code on your login page then yes, you'll just keep redirecting yourself to the home page because you won't be able to login.

Make sure that you do not redirect the user if he's on the login page.

EDIT: Try header('Location: /'); Maybe you have some weird server issue which causes $_SERVER['HTTP_HOST'] do sometimes be null.

Answer 3

Try using this with a die():

if(!isset($_SESSION['user_name'])) { header("Location: http://user.domain.com"); die();}

If url changes from user to user grab username from db first, and use it in redirection. Try something like:

...
$username = $row["username"];
...

and use it:

if(!isset($_SESSION['user_name'])) { header("Location: http://".$username.".domain.com"); die();}