0
\$\begingroup\$

I am redirecting mobile devices from the root index.php to mobile.php file. I only allow access to mobile.php file only when that if statement is true.

This is how I do it:

  1. Detect Devices and store them into variables
  2. If a mobile device (see variables) accesses the web application redirect to mobile.php
  3. In mobile.php check again the same thing and redirect back to index.php if the device is not a mobile device.

    Is this a good practice to redirect mobile devices to another file?

Is there any tool to check my script from false positives?

index.php

    <?php #detecting mobile devices
    $iphone = strpos($_SERVER['HTTP_USER_AGENT'],"iPhone");
    $android = strpos($_SERVER['HTTP_USER_AGENT'],"Android");
    $palmpre = strpos($_SERVER['HTTP_USER_AGENT'],"webOS");
    $berry = strpos($_SERVER['HTTP_USER_AGENT'],"BlackBerry");
    $ipod = strpos($_SERVER['HTTP_USER_AGENT'],"iPod");
    $ipad = strpos($_SERVER['HTTP_USER_AGENT'],"iPad");

    if($iphone || $android || $palmpre || $ipod || $berry || $ipad == true) 
{   
 header('Location: mobile.php');
 exit;
}
    ?>

mobile.php

<?php #detecting mobile devices
$iphone = strpos($_SERVER['HTTP_USER_AGENT'],"iPhone");
$android = strpos($_SERVER['HTTP_USER_AGENT'],"Android");
$palmpre = strpos($_SERVER['HTTP_USER_AGENT'],"webOS");
$berry = strpos($_SERVER['HTTP_USER_AGENT'],"BlackBerry");
$ipod = strpos($_SERVER['HTTP_USER_AGENT'],"iPod");
$ipad = strpos($_SERVER['HTTP_USER_AGENT'],"iPad");


if($iphone || $android || $palmpre || $ipod || $berry || $ipad == true) 
{  
//do nothing
} 
else{ #device not one of the variables return to root file
header('Location: index.php');
exit;
}

 ?>
\$\endgroup\$
3
\$\begingroup\$

You should consider using some library for mobile device detection, like Mobile-Detect. Your script will improperly detect many devices - this will be a big problem if you fill force redirection to mobile/desktop version of website based on false-positives.

Is this a good practise to redirect mobile devices to another file?

It is a bad idea to force it. You should allow to choose which version (mobile or desktop) user wants to browse. So you may redirect him on first visit, but allow to switch between versions at any time.

\$\endgroup\$
  • \$\begingroup\$ Is there any online tool to check my website for false positives? \$\endgroup\$ – csandreas1 Apr 26 '18 at 6:30
  • \$\begingroup\$ @csandreas1 I don't know any, but since you're only testing string from user agent, you may use data from unit tests of Mobile-Detect package and write own unit tests for this: github.com/serbanghita/Mobile-Detect/blob/master/tests/… \$\endgroup\$ – rob006 Apr 26 '18 at 10:29
3
\$\begingroup\$

The global task of mobile detection aside, just in regard of the current implementation.

Every time you see a duplicated code, there is a room for the improvement.

$mobile = false;
$mob_agents = ["iPhone","Android","webOS","BlackBerry","iPod","iPad"];
foreach ($mob_agents as $marker) {
if (strpos($_SERVER['HTTP_USER_AGENT'], $marker) !== FALSE) {
    $mobile = true;
    break;
}

now you can use a $mobile variable to test whether it's a movile client or not

A more sophisticated version would involve basic regular expressions- something like this:

$pattern = "/iPhone|Android|webOS|BlackBerry|iPod|iPad/";
$mobile = preg_match($pattern, $_SERVER['HTTP_USER_AGENT']);
\$\endgroup\$
  • \$\begingroup\$ i did not get what you improved from my code, can you explain? \$\endgroup\$ – csandreas1 Apr 25 '18 at 16:37
  • \$\begingroup\$ Does my answer give an ample explanation? If not, let me know what else you don't get. \$\endgroup\$ – Sᴀᴍ Onᴇᴌᴀ Apr 26 '18 at 17:24
2
\$\begingroup\$

Is this a good practise to redirect mobile devices to another file securely?

If we're talking about security, we should first ask: what are we really trying to achieve?

Why do you want to disallow direct access to mobile.php? If one is on a mobile device, why shouldn't he be allowed to directly go there?

What kind of security problems are you trying to prevent by not allowing such direct access?

Seems to me that it's more of an inconvenience for the user.

Is this a good practise to redirect mobile devices to another file?

In general, I would say: no, just serve the same page for all kinds of devices, regardless of mobile or not.

Perhaps though you have some sort of reason why you want to serve one kind of page to to mobile users. Without knowing that, however, I can't really assess whether your solution is good or bad.

\$\endgroup\$
  • \$\begingroup\$ your answer did not answer anything on my question, you are just asking. I just don't want users to see that file, only people from mobile device should \$\endgroup\$ – csandreas1 Apr 25 '18 at 15:19
  • \$\begingroup\$ you are true about security i deleted that \$\endgroup\$ – csandreas1 Apr 25 '18 at 15:25
  • \$\begingroup\$ Added reply to your updated question. \$\endgroup\$ – Rene Saarsoo Apr 25 '18 at 18:30
1
\$\begingroup\$

The code in Your Common Sense's answer is a good improvement over the original code, for multiple reasons:

  1. Redundancy is eliminated. It is wise to adhere to the Don't Repeat Yourself (A.K.A. 'DRY') principle. Not only are the calls to strpos() redundant, they appear to be identical within the two files. If you really needed such functionality in multiple files, it might be good to abstract it into a function, perhaps in an included file, and call that function. That way modifications can be done in one place instead of every place the functionality is needed.
  2. While most user agents tend to have the browser name first and then the platform, if the platform happened to be at the start of the string - e.g. "Blackberry Mozilla/5.0..." then strpos() would yield 0, which evaluates to false. Note the warning on the PHP documentation for strpos():

    Warning This function may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE. Please read the section on Booleans for more information. Use the === operator for testing the return value of this function.

I also wanted to point out that the == true on these lines:

if($iphone || $android || $palmpre || $ipod || $berry || $ipad == true)   

only applies to $ipad and not all of the variables combined via the OR operators. You probably know this but one could omit the == true, since anything that doesn't evaluate to a boolean FALSE will be considered TRUE1.

1http://php.net/manual/en/language.types.boolean.php#language.types.boolean.casting

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.