Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I found this in the header.php file of a e-commerce site. Is this better done in a .htaccess file.

Also what would happen to any post parameters that get caught in the header statement.

// flip between secure and non-secure pages
$uri = $_SERVER['REQUEST_URI'];

// move to secure SSL pages if required
if (substr($uri,1,12) == "registration") 
{
    if($_SERVER['SERVER_PORT'] != 443) {   
       header("HTTP/1.1 301 Moved Permanently");
       header("Location: https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
       exit();
    }
}
// otherwise us regular non-SSL pages
else
{
     if($_SERVER['SERVER_PORT'] == 443) {   
        header("HTTP/1.1 301 Moved Permanently");
        header("Location: http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']);
        exit();   
    }
}   
share|improve this question
add comment

1 Answer

Yes, this could be done in the .htaccess file using mod_rewrite for instance. But why bother ? The application writer probably did not want to assume a specific web server or increase the complexity of the server configuration, and so handled it at the application level.

I believe the POST parameters would be lost in translation, but one must assume that's something the application writer took into consideration.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.