[sby247]

I have a problem with my webpage secure script. Even after logout, wen I hit the back button on my browser, I can still access the secure page. I can still even access the assigned page without login instead of redirecting to "login.php". I don't know what might be wrong with the variable or scripting. I have tried the "||", "&&" and "or" variable and it work. Here is the secure page script.


<?php
//Start session
session_start();

//Check whether the session variable SESS_MEMBER_ID is present or not
if(!isset($_SESSION['login']) xor (trim($_SESSION['login']) == '')) {
header("location: login.php");
exit();
}
?>


Here is the logout out script :

<?php
//Start session
session_start();
session_destroy();

//Unset the variables stored in session
unset($_SESSION['login']);

//Redirect use to login page
header("location: login.php");

Please I need to get this resolve ASAP. Thanks in anticipation.

[nishchal_619]

i think you shuold use cookie for this but remember cookie is not so secure until you encrypt it, use crypt() function to encrypt the data in the variable (dont use md5 hasing because it can be decrypted) you can easily make your method
suppose you have variable $user then to encrypt it,
$enc=crypt($password,"wrt what you are encrypting");

since you can give the second variable and it is secure in your mind, even if some one view cookie, he wont be able to understand what is that, then you need to store cookie when username and password matches
setcookie("username",$user,time()+3600);
//i did 3600 to expire the cookie in 1 hrs, means user can use up to 1 hour, (note time is in seconds) you can make keep me logged in box and set the expiration time to 1month and if not then dont give the expiration time just leave up to setcookie("username",$user) in this case cookie will be cleared as soon as user exits the browser
now we have to redirect to home page but in the home page you need to check for the cookie if it is set and password matches if cookie is present and encrypted data in cookie is equal to the data in the database after data of data is encrypted then password matches
suppose encrypted data of nishchal is
ladfoiafe;po with respect to some keyword, then we have to acess the database, suppose password is nishchal in the database also so if i encrypt the "nishchal" which is in database then encrypted data in cookie will be equal to the encrypted data just now then you may make a good site this facebook and i also in many websites have used this technique, this is a professional method of developing a website

[kameshoddanchatram]

Halow i am kamesh i saw that you have anproblem with your login script you had made a mistake
at "or " function you had type xor .