Sessions not working, overlapping each other

Question

I'm having a problem with my sessions, I have a functionality in my application which requires two different type of users logging in, one is the Admin, with that means he can do everything possible within the application, and other is the Editor, and he can only do a couple of things in it.

My problem is that the sessions seem to be overlapping one another, I login in the admin and the session info is the one from the Editor.

Heres my login from the Admin:

<!---Login PHP--->
<?php
  if( isset($_POST['btn-login']) ) {
    
    $email = $_POST['email'];
    $senha = $_POST['senha'];
    
    $Error = false;

    if (empty($email)) {
        $Error= true;
        $error = "Preencha o email.";
    }
    
    if (empty($senha)) {
        $Error = true;
        $error2 = "Preencha a senha.";
    }
   if($email) {         
            $sql = "SELECT email FROM admin WHERE email = '$email'";
            $stmt = $conn->prepare($sql);
            $stmt->execute();
            $cout = $stmt->rowCount();
            //echo "Email - ".$cout;
        }
        if($senha) {
            $sql = "SELECT senha FROM admin WHERE email = '$email'";
            $stmt = $conn->prepare($sql);
            $stmt->execute();
            $cout = $stmt->rowCount();
            if($cout == 1) {
            //echo "<br>Password - ".$cout;
                $hashed = $stmt->fetch(PDO::FETCH_ASSOC);
                //echo "<br>Password HASHED - ".$hashed['senha'];
                $hashed_pass = $hashed['senha'];
            }
        }
    
    

    if (!empty($email) && !empty($senha) && filter_var($email,FILTER_VALIDATE_EMAIL) && password_verify($senha,$hashed_pass) && !$Error) {
        
        $sql = "SELECT email, senha FROM admin WHERE email ='$email' AND senha = '$hashed_pass'";
        $query = $conn->prepare($sql);
        $query->execute();
        $count = $query->rowCount();
        
            if($count == 1){                    
                session_start();
                    $_SESSION['email'] = $email;
                    $_SESSION['senha'] = $crypt;
                    header("Location: home.php");
                    exit;
            }

            else {
                
                $error = "Erro: password ou email errados";
                
            }
    
  }
  }

    ?>

Here's my Editor login:

 <?php
 /*EDITOR*/
    if( isset($_POST['btn-login2']) ) {
    
    $email = $_POST['email'];
    $senha = $_POST['senha'];

    if (empty($email)) {
        echo "Preencha o email";
    }
    
    if (empty($senha)) {
        echo "Preencha a senha";
    }
   if($email) {         
            $sql = "SELECT email FROM editor WHERE email = '$email'";
            $stmt = $conn->prepare($sql);
            $stmt->execute();
            $cout = $stmt->rowCount();
            //echo "Email - ".$cout;
        }
        if($senha) {
            $sql = "SELECT senha FROM editor WHERE email = '$email'";
            $stmt = $conn->prepare($sql);
            $stmt->execute();
            $cout = $stmt->rowCount();
            if($cout == 1) {
            //echo "<br>Password - ".$cout;
                $hashed = $stmt->fetch(PDO::FETCH_ASSOC);
                //echo "<br>Password HASHED - ".$hashed['senha'];
                $hashed_pass = $hashed['senha'];
            }
        }
        

    if (!empty($email) && !empty($senha) && filter_var($email,FILTER_VALIDATE_EMAIL) && password_verify($senha,$hashed_pass)) {
        
        $sql = "SELECT email, senha FROM editor WHERE email ='$email' AND senha = '$hashed_pass'";
        $query = $conn->prepare($sql);
        $query->execute();
        $count = $query->rowCount();
        
            if($count == 1){
                session_start();

                    // criar sessão com o email recebido por post e mandar o utilizador para a página home
                    $_SESSION['email_e'] = $email;
                    $_SESSION['senha_e'] = $senha;
                    header("Location: home.php");
                    exit;
            }

            else {
                
                echo "Erro: password ou email errados";
                
            }
    
  }
  }
  ?>

And here is the Sessions file:

<?php 
    ob_start();
    session_start();
    // if session is not set this will redirect to login page
    if( !isset($_SESSION['email']) && !isset($_SESSION['senha'])) {
        header("Location: admin.php");
        exit;
    } 
    // ADMIN SESSIONS
    if(isset($_SESSION['email'])){
    //echo "entrei";
        // select loggedin users detail
        $res = "SELECT * FROM admin WHERE email='".$_SESSION['email']."'";
        $stmt = $conn->prepare($res);
        //echo "<br>SQL - > ".$res;
        $stmt ->execute();
        $count = $stmt ->rowCount();
        if ( $count == 1 ) {
            $userRow = $stmt->fetch(PDO::FETCH_ASSOC);
        }       
    }
    //EDITOR SESSIONS
    if(isset($_SESSION['email_e'])) {
    //echo "<br>Entrei2";
        $sql = "SELECT * FROM editor WHERE email = '".$_SESSION['email_e']."'";
        //echo "<br>SQL - > ".$sql;
        $stmt = $conn->prepare($sql);
        $stmt->execute();
        $count = $stmt->rowCount();
        if($count == 1) {
            $userRow = $stmt->fetch(PDO::FETCH_ASSOC);
        }
        //echo "<br>Contagem - ".$count;
    }  else {
    echo "<br>Sem Sucesso";
    }

?>

And when I was trying to fix this problem I though it might be because I didn't destroy the sessions, but still no fix with that, I'm probably doing something wrong here I believe.

Logout file:

<?php
    session_start();
    ob_start();
    
    if (!isset($_SESSION['email']) || !isset($_SESSION['email_e'])) {
        header("Location: index.php");
        exit();
    } else if(isset($_SESSION['email'])!="") {
        header("Location: index.php");
        exit();
    }
    //ADMIN LOGOUT
    if (isset($_GET['logout'])) {
        unset($_SESSION['email']);
        unset($_SESSION['email_e']);
        session_unset();
        session_destroy();
        header("Location: error.php");
        exit;
    }
    ob_end_flush();
?>

Thanks in advance to anyone who answers.

Answer 1

It seems weird to me that you are handling the 2 types of users by creating 2 different session variables. What I believe that is happening is that somehow one of the variables does not get unset, and thus resulting in your problem.

It would be much more simple and elegant to use the same variable ( $_SESSION['email'] ) and then display whatever content you want based on the user type.

Think that you want, at some point, to add a new user type: you would have to edit all the code that handles the login and logout, which is not normal.

Try to only create one login page, for both admins and editors, and get their user type from the database based on their email.