replace from href

checkin.php

@@ -9,7 +9,7 @@ if(!isset($hash)) die();
 if(!isset($from)) die();
 
 if(strlen($hash) != 64){
-    echo "<script>alert('Illegal Hash!!');window.location.href='https://login.yimian.xyz/'</script>";
+    echo "<script>alert('Illegal Hash!!');window.location.replace('https://login.yimian.xyz/')</script>";
     die();
 }
 
@@ -46,7 +46,7 @@ echo '<meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><titl
 
 
 if(!db__getData($cnn, "account", "hash", $hash)[0]['nickname']){
-    echo "<script>window.location.href='https://login.yimian.xyz/setNickname.html?from=$from'</script></body></html>";
+    echo "<script>window.location.replace('https://login.yimian.xyz/setNickname.html?from=$from')</script></body></html>";
 }else{
-    echo "<script>window.location.href='$from'</script></body></html>";
+    echo "<script>window.location.replace('$from')</script></body></html>";
 }

checkout.php

@@ -18,6 +18,6 @@ if(isset($_COOKIE['_token']) && db__rowNum($cnn, "token", "token", $_COOKIE['_to
 }
 
 if($from)
-    echo '<script>window.location.href="'.base64_decode($from).'"</script>';
+    echo '<script>window.location.replace("'.base64_decode($from).'")</script>';
 else
-    echo '<script>window.location.href="https://login.yimian.xyz/"</script>';
+    echo '<script>window.location.replace("https://login.yimian.xyz/")</script>';

index.php

@@ -36,7 +36,7 @@ echo "<script>$.get('https://log.yimian.xyz/iis.php', async (data)=>{
     data = JSON.parse(data);
     $.get('/setFip.php?seed=$seed&fp='+(await fp)+'&ip='+data.ip, (res)=>{
         if(res.code == 200){
-            window.location.href='$from';
+            window.location.replace('$from');
             return;
 }else if(res.code == 500){
     cookie.del('_token');