prevent url tampering in php <p>This is a test engine application with 5 papers set by me..as 5 php pages</p> <p>Flow of the application </p> <p>Login.html </p> <p>check.php // to check whether credentials r right</p> <p>if correct then </p> <p>main.php //user clicks on "take test" in this page which displays him 1 of the 5 papers...</p> <p>but once i am logged in i can just change the url to the url of the test paper i want..the paper names r 1.php 2.php....</p> <p>how do i stop this...??</p> <pre><code>if(!isset($_SESSION['page'])//Tp continue; //Tp else { header('Location:login.php'); exit; } //Tp $_SESSION['page']=$_SERVER['SCRIPT_NAME'];//tp </code></pre> <p>is this correct...as i said there are 5 pages....</p> <p>in eac page i have this code....</p> <p>i check whether the Session variable is set....if it is set...it means it already has visited the page.....but this code doesnt work...did i use the variable _SESSION['page'] before declaring it???</p>