1 common.inc backdrop_goto($path = '', array $options = array(), $http_response_code = 302)

Sends the user to a different page.

This issues an on-site HTTP redirect. The function makes sure the redirected URL is formatted correctly.

If a destination was specified in the current request's URI (i.e., $_GET['destination']) then it will override the $path and $options values passed to this function. This provides the flexibility to build a link to user/login and override the default redirection so that the user is redirected to a specific path after logging in:

  $query = array('destination' => "node/$node->nid");
  $link = l(t('Log in'), 'user/login', array('query' => $query));

Backdrop will ensure that messages set by backdrop_set_message() and other session data are written to the database before the user is redirected.

This function ends the request; use it instead of a return in your menu callback.


$path: (optional) A Backdrop path or a full URL, which will be passed to url() to compute the redirect for the URL.

$options: (optional) An associative array of additional URL options to pass to url().

$http_response_code: (optional) The HTTP status code to use for the redirection, defaults to 302. The valid values for 3xx redirection status codes are defined in RFC 2616 and the draft for the new HTTP status codes:

  • 301: Moved Permanently (the recommended value for most redirects).
  • 302: Found (default in Backdrop and PHP, sometimes used for spamming search engines).
  • 303: See Other.
  • 304: Not Modified.
  • 305: Use Proxy.
  • 307: Temporary Redirect.

See also



Related topics


core/includes/common.inc, line 839
Common functions that many Backdrop modules will need to reference.


function backdrop_goto($path = '', array $options = array(), $http_response_code = 302) {
  // A destination in $_GET always overrides the function arguments.
  // We do not allow absolute URLs to be passed via $_GET, as this can be an attack vector.
  if (isset($_GET['destination']) && !url_is_external($_GET['destination'])) {
    $destination = backdrop_parse_url($_GET['destination']);
    // Double check the path derived by backdrop_parse_url() is not external.
    if (!url_is_external($destination['path'])) {
      $path = $destination['path'];
    $options['query'] = $destination['query'];
    $options['fragment'] = $destination['fragment'];

  // In some cases modules call backdrop_goto(current_path()). We need to ensure
  // that such a redirect is not to an external URL.
  if ($path === current_path() && empty($options['external']) && url_is_external($path)) {
    // Force url() to generate a non-external URL.
    $options['external'] = FALSE;

  backdrop_alter('backdrop_goto', $path, $options, $http_response_code);

  // The 'Location' HTTP header must be absolute.
  $options['absolute'] = TRUE;

  $url = url($path, $options);

  if (!backdrop_is_background()) {
    header('Location: ' . $url, TRUE, $http_response_code);

  // The "Location" header sends a redirect status code to the HTTP daemon. In
  // some cases this can be wrong, so we make sure none of the code below the
  // backdrop_goto() call gets executed upon redirection.