Continuing to execute code after sending a redirect could have a number of dire consequences. Among them:


* Exposure of sensitive data
* Denial-of-service vulnerability
* Remote file execution and path traversal
* Remote attacker access to administrator functionality
* Injection of malicious code


== Noncompliant Code Example

----
if (!isAuthorized($user)) {
  http_redirect($deniedUrl);
}
echo $_ENV("DOCUMENT_ROOT");  // Noncompliant
----


== Compliant Solution

----
if (!isAuthorized($user)) {
  http_redirect($deniedUrl);
}
----


== See

* http://cwe.mitre.org/data/definitions/698.html[MITRE, CWE-698] - Execution After Redirect (EAR)

