php code executes after a header redirect!?

[zander1983]

Hi

I've been working on a site for 6 months and have used the header command to redirect loads and loads of times. But i just noticed some crazy behaviour today. Heres a test page:

 

<?php

include("includes/db_connect.php");

 

header('location:stores.php');

 

 

$sql = "insert into test (id) values (77)";

$result = mysql_query($sql);

?>

 

when i hit this page, i get redirected to stores.php, but the sql gets executed! Is this supposed to be the behaviour? Have i completely missed the point of header(location:)?? Im baffled as i've used this before, but only now noticed this crazy behaviour!

[PFMaBiSmAd]

The only thing a header() statement does is send a raw http header to the browser -

 

Description

void header ( string $string [, bool $replace = true [, int $http_response_code ]] )

header() is used to send a raw HTTP header. See the » HTTP/1.1 specification for more information on HTTP headers.

 

If you want your php code to stop executing, you must put an exit; statement after the header() statement.

[zander1983]

that worked, thanks. Ive been using header(location) for years without knowing this! thanks!

[PFMaBiSmAd]

A lot of people don't put exit; statements after header() redirects in their login check code and bot scripts can access the 'protected' pages the same as if the security check code isn't even present.