CODEWITHSUNDEEP
phpmysqli
Spud91
Spud91

Reputation: 69

check if admin or not php

I have a database table that holds a users username, password and other information as well as whether theyre and administrator or not. Its currently set to Char where A is for admin and U is for normal user.

I have the following code which checks if a user exists:

<?php
session_start(); // Starting Session
include_once('config.php');

$error=''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
if (empty($_POST['user']) || empty($_POST['pass'])) {
$error = "Please complete both fields";
}
else
{
// Define $username and $password
$user=$_POST['user'];
$_SESSION['login_user']=$user;
$pass=md5($_POST['pass']);
// To protect MySQL injection for Security purpose
$user = stripslashes($user);
$pass = stripslashes($pass);
$user = mysqli_real_escape_string($mysqli, $user);
$pass = mysqli_real_escape_string($mysqli, $pass);
// SQL query to fetch information of registered users and finds user match.
$result = mysqli_query($mysqli, "SELECT * FROM users WHERE Username='$user' AND Password='$pass'");
if(mysqli_num_rows($result) == 1) {
header("Location: home.php");
} else {
$error = "Username or Password is invalid";
}
mysqli_close($mysqli); // Closing mysqlinection
}
}
?>

<!doctype html>
<html>
<head>
<link rel="stylesheet" type="text/css" href="style/style.css"> 
<script type="text/javascript" src="//code.jquery.com/jquery-2.1.3.min.js"></script>
<title>Login</title>

</head>
<body>

<div id = "logReg">
<span href="#" class="button" id="toggle-login">Log in</span> 
</div>

<div id="login">
  <div id="triangle"></div>
  <h1>Log in</h1>
  <form action = "" id = "logregform" method = "POST">
    <p id = "err"> <?php if(isset($error)) {echo $error;} ?> </p>
    <input id = "logtxt" type="text" placeholder="Username" name = "user" required/>
    <input type="password" placeholder="Password" name = "pass" required/>
    <input type="submit" value="Log in" name = "submit" />
    <br>
    <br>
    <p id ="bklg">Dont have an account? <a href="register.php">Sign up</a></p> 
  </form>
</div>

</html>

How would i check if Account_Type is A and if so direct the user to another page instead of the normal home.php page?

EDIT: It works fine however the admin wont log in. Ive given it test username of 456 and a password of 456 when i enter them into the two textboxes nothing happens, the screen just refreshes and im back on the login page:

new code below:

      <?php
session_start(); // Starting Session
include_once('config.php');

$error=''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
if (empty($_POST['user']) || empty($_POST['pass'])) {
$error = "Please complete both fields";
}
else
{
// Define $username and $password
$user=$_POST['user'];
$pass=md5($_POST['pass']);
// To protect MySQL injection for Security purpose
$user = stripslashes($user);
$pass = stripslashes($pass);
$user = mysqli_real_escape_string($mysqli, $user);
$pass = mysqli_real_escape_string($mysqli, $pass);
// SQL query to fetch information of registered users and finds user match.
$result = mysqli_query($mysqli, "SELECT * FROM users WHERE Username='$user' AND Password='$pass'");
if ($row = mysqli_fetch_array($result)) {
    //set the session variables
    $_SESSION['Username'] = $row['Username'];
    $_SESSION['Account_Type'] = $row['Account_Type'];

    if ($row['Account_Type'] === 'A')  {
        header ("location: adminHome.php");
        exit;
    } else {
        header ("location: home.php");
        exit;
    }
} else {
    $error = "Username or Password is invalid";
}
mysqli_close($mysqli); // Closing mysqlinection
}
}
?>

<!doctype html>
<html>
<head>
<link rel="stylesheet" type="text/css" href="style/style.css"> 
<script type="text/javascript" src="//code.jquery.com/jquery-2.1.3.min.js"></script>
<title>Login</title>

</head>
<body>

<div id = "logReg">
<span href="#" class="button" id="toggle-login">Log in</span> 
</div>

<div id="login">
  <div id="triangle"></div>
  <h1>Log in</h1>
  <form action = "" id = "logregform" method = "POST">
    <p id = "err"> <?php if(isset($error)) {echo $error;} ?> </p>
    <input id = "logtxt" type="text" placeholder="Username" name = "user" required/>
    <input type="password" placeholder="Password" name = "pass" required/>
    <input type="submit" value="Log in" name = "submit" />
    <br>
    <br>
    <p id ="bklg">Dont have an account? <a href="register.php">Sign up</a></p> 
  </form>
</div>
<script>

$('#toggle-login').click(function(){
  $('#login').slideToggle('fast'); 
});
</script>
</html>

Upvotes: 1

Views: 2447

Answers (2)

jeroen
jeroen

Reputation: 91744

You are going about this the wrong way. Every page that requires the user to be authenticated should check at the very start if the user is authenticated and at what level. The way to do that is to use the session.

Right now you are setting the session variable before you even check whether the user / password combination is correct so you are effectively logging in anybody who enters a username.

You need to store the variables in the session only upon successful login and as mentioned you need to get a row from your result set to get the user information:

// Personally I would use a prepared statement here
$result = mysqli_query($mysqli, "SELECT * FROM users WHERE Username='$user' AND Password='$pass'");
if ($row = mysqli_fetch_array($result)) {
    // Now you can set the session variables
    $_SESSION['Username'] = $row['Username'];
    $_SESSION['Account_Type'] = $row['Account_Type'];
    // Add any additional user information to the session that you might need later on

    if ($row['Account_Type'] === 'A')  {
        header ("location: adminHome.php");
        exit;
    } else {
        header ("location: home.php");
        exit;
    }
} else {
    $error = "Username or Password is invalid";
}

Now in every page where a user is required you can do:

session_start();
if (isset($_SESSION['Username']))
{
  // valid user, additional checks for user type?
}
else
{
  // not a valid / logged in user
}

Note:

Upvotes: 1

Jaime
Jaime

Reputation: 1410

$row = mysqli_fetch_array($result);
if ($row['Account_Type'] === 'A')  {

} elseif ($row['Account_Type'] === 'U') {

} else {

}

Upvotes: 0

Related Questions