Why does an error occur when restricting access to a profile for unregistered users?

Question

PHP

I am writing a website with authorization and registration. The mechanism works, records are entered into the database, etc. But I also decided to restrict access to some pages for non-registers. users, for example to a profile. As a result, the code does not work.

Here is the profile.php page code :

<?php

    session_start();

    if ($_SESSION['user']) header("Location: index.php");

?>

Here is the authorization mechanism code so that you understand where the user key comes from :

<?php

    session_start();
    require_once 'connection.php';

    $login = $_POST['login'];
    $password = md5($_POST['password']);

    $check_user = mysqli_query($connect, "SELECT * FROM `users_onlycash` WHERE `login` = '$login' AND `password` = '$password'");

    if (mysqli_num_rows($check_user) > 0) {

        $user = mysqli_fetch_assoc($check_user);

        $_SESSION['user'] = [
            "id" => $user['id'],
            "login" => $user['login'],
            "password" => $user['password'],
            "balans" => $user['balans']
        ];

        header("Location: profile.php");

    } else {
        $_SESSION['message'] = "Неверный логин или пароль";
        header("Location: login_page.php");
    }

?>

Also, if I try to restrict access to the authorization page for already registered. users, then the following error is displayed:

Warning: Undefined array key "user" in C:\xampp\htdocs\OnlyCash\login_page.php on line 5

I wrote this code from one YouTube video. Everything worked fine for the youtuber and there were no errors, but I downloaded his project to my computer and I get the same errors there. Please help me figure out what the problem is.

Answer 1

It must be understood that the word "youtuber" is a synonym for the word "crooked-handed idiot."
And the problems in this code are much more serious than the banal error that is treated with isset().
Much more important are the two HOLES in this code, in the presence of which what is limited - what is not limited, but whoever wants and how they want will walk around the site.
First, this code does not restrict anything at all. Because after sending the Location header, you must always force the script to exit. because sending a header by itself doesn't do that, of course. And the client can stupidly ignore the header and get the page itself instead of a redirect.
Secondly, of course, the most banal SQL injection, with which anyone can log in under anyone,