Member Avatar for Member #936213

Hey guys ,

i am working on a login page that will only allow an admin login , if the user is part of a trade account or is classed as a customer i would like them to be redirected.

<?php

session_start();
if (isset($_SESSION["superUser"])){
	header("location: index.php");
	exit();
	
}
?>
<?php

if (isset($_POST["username"]) &&isset ($_POST["password"])) {
	$superUser = preg_replace('#[^A-Za-z0-9]#i', '', $_POST["username"]);
	$password = preg_replace('#[^A-Za-z0-9]#i', '', md5($_POST["password"]));

	

//connect to sql data

include "../storescripts/mysql.php";
$sql= mysql_query("SELECT userID FROM user WHERE username='$superUser'  AND password='$password' AND userTypeId = 1 LIMIT 1");

if(!$_POST['username'] | !$_POST['password']) {

 		die('You did not fill in a required Username or Password field. <a href=admin_login.php>Click Here to Try Again</a>');
		exit();
}

//MAKE SURE USER EXISTS

$existCount = mysql_num_rows($sql); //Counts the number of rows 
if($existCount==1){
	while($row = mysql_fetch_array($sql)){
		$userID = $row["userID"];
		
}

$_SESSION["userID"]= $userID;
$_SESSION["superUser"] = $superUser;
$_SESSION["password"] = $password;


header("location: index.php");


exit ();


	}else{
	
 	echo("You have either entered an incorrect Username or Password <a href=admin_login.php>Click Here to Try Again</a>");
	
	
	
	exit();
}
}



?>

As you can see below , the code only selects the user with the userTypeId of 1 which is the id linked to the admins.

include "../storescripts/mysql.php";
$sql= mysql_query("SELECT userID FROM user WHERE username='$superUser'  AND password='$password' AND userTypeId = 1 LIMIT 1");

If i enter a customer account details into the system it recognises that it is a customer however it just posts the echo from this.

}else{
	
 	echo("You have either entered an incorrect Username or Password <a href=admin_login.php>Click Here to Try Again</a>");
	
exit();

if the admin info is correct then the admin is redirected to an index.php . code is below

<?php

session_start();
if(!isset($_SESSION["superUser"])){
	header("location:admin_login.php");
	exit();
}

//be sure to check that this superUser SESSION is in the database
$superUserID = preg_replace('#[^0-9]#i','', $_SESSION["userID"]);
$superUser = preg_replace('#[^A-Za-z0-9]#i', '', $_SESSION["superUser"]);
$password = preg_replace('#[^A-Za-z0-9]#i', '', ($_SESSION["password"]));

//connect to sql data

include "../storescripts/mysql.php";
$sql= mysql_query("SELECT * FROM user WHERE userID='$superUserID' AND username='$superUser' AND password='$password' LIMIT 1");

//MAKE SURE USER EXISTS

$existCount = mysql_num_rows($sql); //Counts the number of rows 
if($existCount==0){
	echo "false details";
	exit();
	
}

?>

What i would like to do is if a customer or trade account try logging into the backend of the system then they get redirected to say access.php. Within this access page just to echo out " Access Denied . Click here....."

Thank you for your time

Edited by Member #936213 because: n/a
  • 2 Contributors
  • 2 Replies
  • 2K Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by Member #936213

Dani AI

Generated

@FakeTales you already have the right idea: gate access by role. Two quick wins to make it cleaner and safer: do a single user lookup, then branch on role for the redirect; and do not store any password (or hash) in the session. Also note that the old mysql_* API you are using was removed from PHP; switch to PDO or MySQLi with prepared statements to avoid SQL injection and stay compatible. (php.net)

Example login flow with PDO and password hashing. One query, clear redirects, no password in session:

// login.php
session_start();
require 'db.php'; // creates $pdo (PDO with ERRMODE_EXCEPTION)

$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';

$stmt = $pdo->prepare('SELECT id, username, password_hash, role FROM users WHERE username = ? LIMIT 1');
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user || !password_verify($password, $user['password_hash'])) {
    header('Location: /admin_login.php?error=1'); exit;
}

session_regenerate_id(true);
$_SESSION['uid']  = $user['id'];
$_SESSION['role'] = $user['role'];

if ($user['role'] !== 'admin') { header('Location: /access.php'); exit; }
header('Location: /admin/index.php'); exit;

On every admin page, keep the guard simple:

session_start();
if (empty($_SESSION['uid'])) { header('Location:/admin_login.php'); exit; }
if (($_SESSION['role'] ?? '') !== 'admin') { header('Location:/access.php'); exit; }

Why this helps:

  • One lookup means fewer chances to leak whether a username exists; users either get in or get a generic failure, as suggested.
  • password_hash/password_verify give you modern, adaptive hashing; no MD5, no manual salts. (php.net)
  • session_regenerate_id(true) on login mitigates session fixation. (php.net)

Tip: keep access.php generic (no extra details), and consider a flash message on the login page so you do not echo errors before sending headers.

Recommended Answers

All 2 Replies

Member Avatar for mikulucky

All you would have to do is like your doing already, if you have a value that states the users type, then if not admin then echo something with a link. Or if the user account as you are only searching for admin users, then if the user is not found based on the credentials that have been passed to you then have a common redirect. Stating that your login failed, please try again.

Member Avatar for Member #936213

Thanks miku i added this code (shown below) and now it works

<?php

$sql1 = mysql_query("SELECT userID FROM user WHERE username='$superUser'  AND password='$password' AND userTypeId != 1 LIMIT 1");
$existcount1 = mysql_num_rows($sql1);
if($existcount1==1){
	while($row = mysql_fetch_array($sql1)){
		$userID = $row["userID"];
		
		}

		$_SESSION["userID"] = $userID;
		$_SESSION["superUser"] = $superUser;
		$_SESSION["password"] = $password;
	
	
	echo("ACCESS DENIED. <a href=admin_login.php>Click Here to Try Again</a>");
	exit();

	}else{
	
	echo ("You have enetered an incorrect Username or Password. <a href=admin_login.php>Click Here to Try Again</a>'");
	
	exit();
	}
	
}


?>
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.