Disable back function on passworded pages

[wendystewart80]

Hi there,
I am currently trying to password a php site.
The login/logout functions work well, but after I log out I can still view the pages of the site when I am not logged in. If I click a link I am asked to log in again but it would be better if it was not possible to use the back function to access these pages.
Is there any way of blocking the back function on my web pages when not logged in?
Many thanks.

Log in page:
[php]
<?
// Login & Session example by sde
// auth.php

// start session
session_start();

// convert username and password from _POST or _SESSION
if($_POST){
$_SESSION['username']=$_POST["username"];
$_SESSION['password']=$_POST["password"];
}

// query for a user/pass match
$result=mysql_query("select * from users
where username='" . $_SESSION['username'] . "' and password='" . $_SESSION['password'] . "'");

// retrieve number of rows resulted
$num=mysql_num_rows($result);

// print login form and exit if failed.
if($num < 1){
echo "You are not authenticated. Please login.<br><br>

<form method=POST action=index.php>
username: <input type=text name=\"username\">
password: <input type=password name=\"password\">
<input type=submit>
</form>";

exit;
}
?> [/php]

[edited by: jatar_k at 7:31 pm (utc) on Dec. 6, 2005]
[edit reason] removed url [/edit]

[jatar_k]

>> after I log out I can still view the pages of the site when I am not logged in.

this sounds like you have your authentication messed up or you are just viewing pages in the browser cache. Can you clarify?

trying to disable the back button is not a very good solution. It can be done with javascript but removing basic browser functionality is never a good option. All the people I have ever talked to about this just say it makes them mad (or confused) and causes them to leave the site.

I would suggest not printing the login form like that but instead redirecting them to a static login page.

When you run your auth script it then just redirects them to a login page if they fail instead of outputting anything.