What’s wrong with my HTTP redirect?

Question

I’m using the following code to redirect the user if he/she logged in correctly (see comments in code). But I’m getting an error. What am I doing wrong?

<?php
   require 'inc/header.php';
   require 'inc/config.php';
   require 'inc/functions.php';
?>

<?

$login = $_POST['login'];

if($login==1)
{

    $username = mysql_escape_string(trim($_POST['username']));
    $passwd = mysql_escape_string(trim($_POST['passwd']));
            $QUERY = "
                SELECT
                    *
                FROM
                    login
                WHERE
                    username = '$username' and password='$passwd'

            ";

            $result = send_query($QUERY);

            $num_rows = mysql_num_rows($result);
            $flag=0;
            if($num_rows == 0)
            {
                //show_error('Invalid username');
                $flag=1;
            }
            else
            {

               //this is correct login so i am trying to forward but i am geting  error
                //here

               header('Location: admin_home.php');
               exit;

            }

}

?>

<div class="left">
            <div class="left_articles">

                <h2>ADMIN LOGIN</h2>
                 <p class="description"><?if($flag== 1 ) echo "invalid login" ; ?> </p>
                <p><form action="admin.php" method="POST">

                    <table border="0">

                        <tbody>
                            <tr>
                                <td>Username</td>
                                <td><input type="text" name="username" value="" /></td>
                            </tr>
                            <tr>
                                <td>Password</td>
                                <td><input type="password" name="passwd" value="" /></td>
                            </tr>
                            <tr>
                                <td></td>
                                <td><input type="submit" value="Login" /></td>
                            </tr>
                            <tr>
                                <td></td>
                                <td></td>
                            </tr>
                        </tbody>
                    </table>
                    <input type="hidden" name="login" value="1" />
                </form>
                </p>
            </div>

            <B> AFTER LOGING INTO ADMIN PANEL YOU CAN DO FOLLOWING THINGS <B>
            <p align="center">
                <ul>
                    <li>Add new Jobtype</li>
                    <li>Add new Questions</li>
                    <li>Modify Selection Cretiria</li>
                </ul>    
            </p>
        </div>

        <div id="right">
            <div class="boxtop"></div>
            <div class="box">
                <p><img src="images/image.gif" alt="Image" title="Image" class="image" /><b>Akshay ipsum dolor sit amet</b><br />consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis.<br /></p>
                <div class="buttons"><p><a href="#" class="bluebtn">Read</a> <a href="#" class="greenbtn">Mark</a></p></div>
            </div>

            <div class="boxtop"></div>
            <div class="box">
                <p><img src="images/image.gif" alt="Image" title="Image" class="image" /><b>Pako dolor sit amet</b><br />consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis.<br /></p>
                <div class="buttons"><p><a href="#" class="bluebtn">Read</a> <a href="#" class="greenbtn">Mark</a></p></div>
            </div>
        </div>    
<?  require 'inc/footer.php'  ?>

Answer 1

You'll want to issue a HTTP Header to redirect the client:

if ($redirect == true) {
  //redirect
  header("Location: http://www.mysite.com/noauth.php"); 

  //And exit
  exit;
}

See PHP Manual on Headers. You need to exercise some care when using headers: they have to be sent before any other output to the client. This includes any rogue white space you might have at the top of your php scripts, which will throw an error if you try and issue a new header.