Headers already sent by..

Familiar with that ?

For some PHP newbies that warning is quite irritating. This an example of script that generate that warning.

<?php
echo "some output here";
header("location: index.php");
?>

Means, there should be on output before the tag header("location: index.php") or the warning will show up. The warning will tell you something like "Cannot modify header information - headers already sent by ....". You have to make sure that no output is made before the header tag. In this case, you have to remove the echo "some output" to make the script works and redirected user to index.php. The other solution if using ob_start() and ob_end_flush(), ob_start() buffers your whole page before load it, so the output will not be load until WHOLE page is buffered. Thus, your script will work and user will redirected to index.php.

<?php
ob_start();
echo "some useless output here";
header("location: index.php");
ob_end_flush();
?>

Or, you could use meta instead of header. Meta is not part of PHP you could use it on plain HTML. Here's how

<?php
echo "some output here";
?>
<meta http-equiv="refresh" content="0;url=index.php">

Using meta, u can make a kind ot imer by modifying the number on content, the above example using content="0... " to diretly redirected user to index.php. You can however, change the value to something like 10, 5, to redirect the user AFTER that many second(s). Cheers.

Register Globals

If your PHP scripts stil rely on register_globals, then I must say.. where had you been? I mean, since PHP 4.20 register_globals has been set off by default, thus your script must not rely on register_globals for security reason. What kind of security reason? Register_globals made it easy for PHP programmers to code. Every variables, whether it's from POST, GET, SESSION, COOKIES, FILES or any other else can be called only by referencing to their variable name. So if have a form that POST $name to let's say file process.php then ini file process.php I can easily call the variable simply using $name. The problem is, it's also easy for attacker or any other people to manipulate the $name variable, the easiest example is making the same named variable but making it not by method POST, e. g

http://somesite.com/process.php?name=somenamehere

which is making a name variable via GET method with value 'somenamehere'. That happens because register_globals threat every variable whether it's POST, GET, or any other that I have metioned before as the same. The above example is about manipulating a POST method using GET. What will happen if the same way used to manipulate SESSION? I believe you get the point. What if ALL scripts I wrote before rely on register_global? First thing, you must change the way you code from now on. Then, fix your scripts so they're compatible with register_globals = Off. The fix is simple, you'll just have to change your variables from $something to $_GET["something"], or $_POST["something"] depending on what method the variables were made from. Ah, you had lots of files that almost impossible to change all the variable, copy paste this script, save it on a file, then include the file to every scripts that rely on register_globals. Here's the scripts:

foreach($_POST AS $key => $value) { ${$key} = $value; } foreach($_GET AS $key => $value) { ${$key} = $value; } foreach($_SESSION AS $key => $value) { ${$key} = $value; } //add your methods (if any) here like the above example

I think the scripts is well self-explained. Other resources about register_globals can be found here and here, and many others using google.