PHP Server Side Scripting Forum

I just figured a bad hole if I call a page and user is not logged in the auth does its job and after login open the requested page
Well, I just figured that typing the URL will call the page and open it without passing by login! Hmmmm.

Here is how I tried to protect the page:

This little code is sitting atop any_file.php
<?

require("login_2/backend.php");

$login_check = $authlib->is_logged();

if (!$login_check) {

include("login_2/html/nologin.html");
exit;

}

else {
include ("any_file.php");

}

?>

the above if a user is not logged goes to
“error need to log”
then: login
and then “loging_done” that send a header

as follow:
<?php

header("Location: ../../any_file.php");
exit;

?>

of course it does not work for it is calling again the same page name any_file.php

so the real question is what should I do to be sure that a page will not open if its correct address is type in the address bar?

Thank you