Trouble redirecting back to previous page after login

Question

I need to redirect the user to the page they came from once they've successfully done one of two things: 1) Entering their Invitation Code, or 2) Logged in.

I am trying to apply the answer posted here, but after spending several hours unsuccessfully trying to get it to work I realized it was time to ask for help.

In order to pare down the code, I have only included the snippets relating to Option 1 (Invitation Code). Additionally, in an effort to first get it working with a simpler version (and to more closely replicate the example given), I have temporarily removed the iframes from these pages.

Code Adding

auth_invite_launch.php

//CODE #1
header("Location:sign_in.php?location=".urlencode($_SERVER['REQUEST_URI']));
$redirect = NULL;
if ($_POST['location'] != '') {
    $redirect = $_POST['location'];
}

sign_in.php

//CODE #2
echo '<input type="hidden" name="location" value="';
if (isset($_GET['location'])) {
    echo htmlspecialchars($_GET['location']);
}
echo '" />';

invite_code - exec.php (sign_in.php is submitted here)

//CODE #3
if ($redirect)) {
    header("Location:".$redirect);
}

Pre-existing Code

createaccount.php

require_once('config/auth_invite_launch.php'); // session_start & checks if authorized
is_user_auth(); // Checks if authorized
is_user_logged(); // Checks if logged in 
get_logged_user_id();
if (is_user_logged() == TRUE) {
    $logged_in = true;
    $user_id = $_SESSION['SESS_USER_ID'];
}

auth_invite_launch.php

function is_user_auth(){
  // Checks if logged in to Member Account or has valid Invite Code
  if (isset($_SESSION['SESS_USER_ID']) || isset($_SESSION['TEMP_INVITE_ID'])){
      return true; 
  }
  //Replaced by CODE #1
  header("location: sign_in.php"); // Redirects if not authorized user
}
// Checks if logged in to member account 
function is_user_logged(){
 if ( isset($_SESSION['SESS_USER_ID']) ){
      return true; 
   }
      return false;
}
// Retrieves ID if logged in to member account, NULL otherwise
function get_logged_user_id(){
   if ( is_user_logged() === TRUE ){
      return $_SESSION['SESS_USER_ID'];
   }
       return null;
}

invite_code - exec.php(sign_in.php is submitted here)

// PRECEDED BY statement to fetch matching invite codes from db
if ($stmt - > rowCount() == 1) {
    $invite = $stmt - > fetch();
    $_SESSION['TEMP_INVITE_ID'] = $invite['idinvite_codes'];
    $_SESSION['TEMP_INVITE_CODE'] = $invite['invitation_code'];
    $invite_code = "true";
    //CODE #3 Added here
} else {
    $invite_code = "false";
    header("location: index.php");
    exit();
}

Answer 1

Your last question in the comments is rather broad: how to trace the execution path in a form-redirect cycle? I'll give it a go.

Let's assume your authorised-only scripts have a login detection device, so that if the user is not logged in, it will redirect to the login system:

if (!isLoggedin())
{
    header('Location: /login.php?location=' . urlencode(getCurrentUrl()));
    exit();
}

So in your login form, you will want a POST action, with a hidden field for the redirect location (it looks like you have this in sign_in.php):

<?php
// Handle post
if ($_POST)
{
    if (loginCorrect())
    {
        // Redirect to the redirect location
        // cleanUrl() should ensure the user input pertains to a
        // local script name, so it cannot be used as a spammer's
        // redirection device
        header('Location: ' . cleanUrl($_POST['redirect']));
        exit();
    }
}
?>
<form method="post">
    <!-- hidden field containing redirect location -->
    <!-- username/password fields -->
</form>

Then you would expect for the URL to get to the redirect location. That's four pages (one repeated):

• Make a request to a authorised-only page
• Redirect to login page if not signed in
• Post either to self or login page handler
• Redirect to originally requested page, assuming credentials are correct

Each of these can be debugged. Purists will say you should use xDebug and a debugger (controlled from within your IDE) but echo and exit are fine. Just add them at the top of the four pages above, and see if the redirect location (or other variables) are correct:

echo 1;
exit();

Sometimes I will add a few of these to see how control works within a single page. Version control is nearly essential here, since it is important to be able to remove them easily - you obviously don't want to deploy code containing debugging statements.

It's worth using View Source on your login form page too, to ensure the hidden field is correctly populated.