In what scenarios is it considered unsound programming practice to use the header('location:...') function in PHP?

It is considered unsound programming practice to use the header('location:...') function in PHP after any output has been sent to the browser, as it can cause headers already sent errors. To solve this issue, you should ensure that no output is sent before using the header() function, or use output buffering to capture any output before sending headers. 

<?php
ob_start(); // Start output buffering

// Your PHP code here

ob_end_clean(); // Clean (erase) the output buffer without sending it to the browser

header('Location: new_page.php'); // Redirect to new page
exit();
?>

Keywords

header function redirect security vulnerability HTTP headers response splitting

Related Questions