How long after sending a header('Location: …') command will the PHP script process?

Question

I have two PHP scripts which both have an "include_once('authentication.inc');" script near the top. Both scripts reference the same authentication file. That authentication file currently performs a header redirect (like "header('Location: index.php');") if the user is not signed in.

In one file (A.php) the immediate next line of code after the include of the authentication file is:

if(isset($_GET['delete']))
   mysql_query("DELETE FROM table WHERE index=".$_GET['delete']);

In the other file (B.php) there are several other includes which occur before the same "delete code" listed above.

So the authenticate.inc file looks like:

if(!valid_credentials($username,$password))
    header('Location: index.php');

And file A.php looks like:

include_once('authenticate.inc');

if(isset($_GET['delete']))
   mysql_query("DELETE FROM table WHERE index=".$_GET['delete']);

And file B.php looks like:

include_once('authenticate.inc');

include_once('other.php');
include_once('file2.php');
include_once('onemore.php');

if(isset($_GET['delete']))
   mysql_query("DELETE FROM table WHERE index=".$_GET['delete']);

Yet when I call A.php?delete=5, that record is deleted from the database while when I call B.php?delete=8 that record is not.

I have checked the 3 intermediary includes and do not see any die() statements, nor any other header redirects.

So while it's clear that A.php is continuing to execute after the header is sent, why isn't B.php doing the same thing? Is the header being sent before the next set of imports?

**

Also: I know to add the die() or exit command after the headers are sent. I'm working on someone else's code and trying to explain behavior, not writing this myself.

**

Answer 1

No way to tell. If the starts are aligned properly, the header coud be sent to the client browser immediately and the bowser will start closing the current connection and request the new URL immediately. This'll cause the current PHP script to start shutting down.

On the other hand, if the caches are slow and the network glitchy, the client browser may not get the redirect header for seconds/minutes/hours, and the script could continue executing indefinitely.

In general you should assume that the moment you've issued a header redirect that the script is basically "walking dead" and should not do any further work.

The sole exception to this rule is that you CAN use ignore_user_abort(TRUE) , which tells PHP to NOT shut down when the remote user disconnects. That'd allow you to continue on working even though the browser has shut down the connection and moved on to the new page.

Answer 2

Update your authenticate.inc file to die() after the redirect. This will prevent any other code from executing.

if(!valid_credentials($username,$password)) {
    header('Location: index.php');
    die();
}

Without it, and depending upon your server configuration, the rest of the PHP code will be executed on the server even after the headers are transmitted back to the client. Until the client closes the connection, the code will run.

Answer 3

Just put an exit() after the header redirect. It will stop all execution after the redirect.

Answer 4

There is probably some output in either of the included files, with echo or other outputting functions. If the browser by then has followed the redirect and aborted the connection, the PHP script will by default exit. You can change this behaviour with ignore_user_abort(true); . You should however use die(); after the Location header. If the query execution is wanted, just put that query before the Location header. Don't forget to use proper escaping for the input, otherwise the script could be a target for a mysql injection attack.

Answer 5

To answer your question, it seems that the browser will wait until your script finished execution and only then will request another location.

Please note that you shouldn't use GET method to delete records.

As for the not deleting id=8 - just debug it. Not a big deal.
A good var_dump() is always better than some vague ideas about headers.