title: prevent url tampering in php
body: <p>This is a test engine application with 5 papers set by me..as 5 php pages</p>
  
  <p>Flow of the application </p>
  
  <p>Login.html  </p>
  
  <p>check.php // to check whether credentials r right</p>
  
  <p>if correct then </p>
  
  <p>main.php  //user clicks on "take test" in this page which displays him 1 of the 5 papers...</p>
  
  <p>but once i am logged in i can just change the url to the url of the test paper i want..the paper names r 1.php 2.php....</p>
  
  <p>how do i stop this...??</p>
  
  <pre><code>if(!isset($_SESSION['page'])//Tp
          continue;           //Tp
  else
   {
     header('Location:login.php');
     exit;
   }                               //Tp
  $_SESSION['page']=$_SERVER['SCRIPT_NAME'];//tp
  </code></pre>
  
  <p>is this correct...as i said there are 5 pages....</p>
  
  <p>in eac page i have this code....</p>
  
  <p>i check whether the Session variable is set....if it is set...it means it already has visited the page.....but this code doesnt work...did i use the variable _SESSION['page']
  before declaring it???</p>