Q:

Issue with session_start(), ob_start() and security

In my web admin area I have using very simple logic:
session_start(); ob_start();
if(!isset($_SESSION['user'])){
    header("Location: login.php");
}
contents...
ob_end_flush();

Yes this is working perfect, redirect to login page. But the comic point is that I can see the content of index.php (that protected!!!) here 
What is wrong?

A:

Abra kadabra
if(!isset($_SESSION['user'])){
    header("Location: login.php");
    die("GET LOST YO");
}

A:

Put an ob_end_clean and exit after the header call to prevent any further execution/output:
if (!isset($_SESSION['user'])) {
    header("Location: login.php");
    ob_end_clean();
    exit;
}

