PHP code defaulting to an error when it shouldn't be

Question

I had a PHP developer create a redirection script that redirects users in specific states to another URL, while letting everyone else visit the website.

The problem is it's redirecting everyone who doesn't match a state listed to the error URL, when it should be letting them visit the site.

I think there's a return missing? What do you guys think?

<?php
ini_set('display_errors',1);
ini_set('display_startup_errors',1);
error_reporting(-1);

require_once '/vendor/autoload.php';

use MaxMind\Db\Reader;

$databaseFile = '/geoip/GeoIP2-City.mmdb';
$ipWhiteList = ['123', '321'];

if(!in_array($_SERVER["REMOTE_ADDR"], $ipWhiteList)) {
    $reader = new Reader($databaseFile);
    $iso_code = $reader->get($_SERVER["REMOTE_ADDR"])['subdivisions'][0]['iso_code'];
    if (!isset($_REQUEST['HTTP_REFERER'])) {
        switch($iso_code) {
            case NJ:
                $url = 'http://example.com';
                break;
            case DE:
                $url = 'http://example.com';
                break;
            default:
                $url = 'http://www.example.com/?=error';
                break;
        }
        $reader->close();
        header('Location: '.$url);
        die();
    } else {
        if(strpos($_SERVER['HTTP_REFERER'], "example2.com") > -1) {
            echo "You were redirected from ".urldecode($_REQUEST['referer']).", but it is not available in your area (".$iso_code.").";
            break;
        } else {
            echo "Welcome!";
            break;
        }
    }
}
?>

Answer 1

Try this. If the state is not from NJ or DE, then do nothing.

<?php
ini_set('display_errors',1);
ini_set('display_startup_errors',1);
error_reporting(-1);

require_once '/vendor/autoload.php';

use MaxMind\Db\Reader;

$databaseFile = '/geoip/GeoIP2-City.mmdb';
$ipWhiteList = ['123', '321'];

if(!in_array($_SERVER["REMOTE_ADDR"], $ipWhiteList)) {
    $reader = new Reader($databaseFile);
    $iso_code = $reader->get($_SERVER["REMOTE_ADDR"])['subdivisions'][0]['iso_code'];
    if (!isset($_REQUEST['HTTP_REFERER'])) {
        switch($iso_code) {
            case NJ:
                $url = 'http://example.com';
                header('Location: '.$url);
                                die();
                break;
            case DE:
                $url = 'http://example.com';
                header('Location: '.$url);
                die();
                break;
            default:
        }
        $reader->close();
    } else {
        if(strpos($_SERVER['HTTP_REFERER'], "example2.com") > -1) {
            echo "You were redirected from ".urldecode($_REQUEST['referer']).", but it is not available in your area (".$iso_code.").";
            break;
        } else {
            echo "Welcome!";
            break;
        }
    }
}
?>

Answer 2

Maybe try loading all the valid values, and checking to make sure it's valid, even if it's not NJ/DE.

if (in_array($state, array('NJ', 'DE'))) {
    // Redirect
} elseif (!in_array($states, $all_states_array)) {
    // Go to error.
}

The else is implied, in that the script will just continue working. You could structure this several different ways, depending on how much you need to extend it:

if (!in_array($state, $all_states_array)) {
    // Error
}

if (in_array($state, array('NJ', 'DE'))) {
   // Redirect
}

You could also add all the cases:

case 'DE':
    // Do something;
    break;
case 'NJ':
    // Do soemthing;
    break;
case 'PA':
case 'AL':
case 'NY':
case 'OK':
case 'TX':
...
    // Valid, but not the right target.
    break;
default:
    // show error