JavaScript: redirect users based on incoming URL

[SRD]

Hi,

I have a verification script at the index page of my site. If the verification is passed the user is redirected to the main page. Is there a way that I can prevent users from simply visiting the url to the main page by redirecting them through the verification if their incoming url is not the verification page?

Thanks!

[PeejAvery]

Yes, but that would be server-side scripting.

Using PHP...
1. Create a session
2. Make session variable named "verified"
3. If verification takes place, make it's value = true
4. On main page at the top, check to see if value is true
5. If false, send back to verification

<?php
session_start();
$isverified = $_SESSION['verified'];
if($isverified !== true){header("Location: index.php");}
?>

[SRD]

I really have to use JavaScript. Can't I use the history Object?

[PeejAvery]

I really have to use JavaScript. Can't I use the history Object?
Your problem here is not JavaScript redirecting. How do you plan to tell using JavaScript whether the user verified or not?

Any verification needs to be server-side or else it can be gotten around easily.

[SRD]

Is there a way that I can call this php fuction from an HTML document?

[PeejAvery]

Is there a way that I can call this php fuction from an HTML document?
You can put it in an HTML page if the web server is configured to have PHP extension of HTML.

[SRD]

Isn't there a way that users can disable sessions from within their browsers? If so, wouldn't that result in an infinite loop, rerouting users to the verification page over and over again?

[PeejAvery]

Isn't there a way that users can disable sessions from within their browsers?
Not sessions. You can disable cookies but sessions are set by the server and only the server can change that.

[cypher5783]

you can also put PHP into an HTML document without the server setup to parse php in an html like this


<script language="PHP">
....code goes here
</script>

[PeejAvery]

Well, I have never heard of that before. But, if it works, the only reason it would is if the client machine had installed PHP and configured it for the browser.

[cypher5783]

Well maybe i misunderstand it but here's a quote from my php5 book.


Although <?php and ?> are generally used, the follow are also valid code block seperators:

<? ... ?> Shorthand version of <?php and ?>

<% ...%> ASP style

<SCRIPT LANGUAGE="PHP">

...

</SCRIPT> HTML compatible syntax

Note that some of these code block seperators function only when the associated php.ini configuration directive is enabled. Unless there is a specific reason not to, using the default <?php and ?> is strongly recommended.