Well the below code is very simple and works ok. You may want to consider if it secure enough for your needs. For instance make the password MD5 ect
Login Script could be similiar to this
<?php session_start();
include('db_config.php');
$errmsg_arr = array();
$errflag = false;
include ("database.php");
function clean($str) {
$str = @trim($str);
if(get_magic_quotes_gpc()) {
$str = stripslashes($str);
}
return mysql_real_escape_string($str);
}
$login = clean($_POST['login']);
$password = clean($_POST['password']);
if($login == '') {
header("Location:../index.php");
exit();
} elseif(strlen($login) > 7){
header("Location:../accessdenied.php");
exit();
}
if($password == '') {
header("Location:../index.php");
exit();
}
$qry="SELECT user_id, user_name, access from users WHERE user_id='$login' AND password='$password'";
$result=mysql_query($qry);
if($result)
{
if(mysql_num_rows($result) == 1) {
session_regenerate_id();
$user = mysql_fetch_assoc($result);
$_SESSION['SESS_USER_ID'] = $user['user_id'];
$_SESSION['SESS_USER_NAME'] = $user['user_name'];
$_SESSION['SESS_ACCESS'] = $user['access'];
header("location:../{$_SESSION['SESS_ACCESS']}.php");
session_write_close();
exit();
}else {
header("location:../loginfailed.php");
exit();
}
}else {
die("ERR- The connection to the database has failed, or the Query has failed");
}
?>Put this at the top of each page after your logged in.
<?php
if(!isset($_SESSION['USER_ID']) || (trim($_SESSION['USER_ID']) == '')) {
include("accessdenied.php");
exit();
}
else{
if(!isset($_SESSION['SESS_ACCESS'])){
include("accessdenied.php");
}}
?>You could even have if statements that relate to the access in the DB. eg if (access!="admin"){ show access denied ect }
