I want to create a page which someone can view only if he is registered and granted access to.

For granting access to a user for i use a row in the #__users table named activated2.

So i created a view file inside a component and my view.html.php file is like that:

class IpropertyViewVtourpaketa extends JView
  function display($tpl = null)
                 $user = JFactory::getUser();

                 if (!$user) {

                  header('Location:index.php?msgvtour=You need to register and get activated');

                else {
                 $db= JFactory::getDBO();
                 $query='SELECT activated2 from `#__users` where id='.$user->id;


                 if ($pro==0) {

                     header('Location: index.php?msgvtour=You need to get activated');
                 }else {

                // Display the view

So what im doing is : check if he is registered, if not redirect him . Then check if he is activated, If not redirect him. Else redirect to the view where he can see the page. This is working really nice altough what i wanted to know is:

How safe is this way i use? Could this be easily hacked or bypassed?

2 Answers 2


There are some things I would change:

  • You should not put your database queries in this file. Joomla uses MVC, therefore your queries should be put in a function, in the model.
  • Don't use PHP's default header() function. Instead make full use of the Joomla API for redirecting
  • Rather than adding your own column (activated2) to the #__users table which is a bad idea, I'd suggest you make full use of Joomla's ACL Management for your component.
  • For the database query, I'd suggest using Joomla's methods rather than writing it in plain SQL. Here here for more information

Hope this helps

  • i use $app->redirect(JRoute::_('index.php', false)); as in API, altough i get redirected @ index.php?option=com_iproperty any idea on whats wrong ?
    – IseNgaRt
    Aug 6, 2015 at 11:32

No, your code is not right.

  • JFactory::getUser() always returns a user object. If user is a guest, $user->id == 0 or better ($user->guest)
  • In #__users table, there is no user id 0
  • index.php?msgvtour does not seem to belong to Joomla world
  • Instead of "header('Location:...", it is better to work with Joomla API (check )

For example, from components/com_users/views/profile/view.html.php:

 * Execute and display a template script.
 * @param   string  $tpl  The name of the template file to parse; automatically searches through the template paths.
 * @return  mixed   A string if successful, otherwise a Error object.
 * @since   1.6
public function display($tpl = null)
    // View also takes responsibility for checking if the user logged in with remember me.
    $user = JFactory::getUser();
    $cookieLogin = $user->get('cookieLogin');

    if (!empty($cookieLogin))
        // If so, the user must login to edit the password and other data.
        // What should happen here? Should we force a logout which destroys the cookies?
        $app = JFactory::getApplication();
        $app->enqueueMessage(JText::_('JGLOBAL_REMEMBER_MUST_LOGIN'), 'message');
        $app->redirect(JRoute::_('index.php?option=com_users&view=login', false));

        return false;


    return parent::display($tpl);
  • 1
    Instead of if ($user->id == 0) I would use if ($user->guest) :-)
    – Bakual
    Aug 6, 2015 at 10:20
  • Right! I always forget it
    – Anibal
    Aug 6, 2015 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.