用户“ admin”登录时显示编辑按钮

Question

I want to be able to display the edit button when user "admin" is logged in. Here is my code for the login page:

<?PHP

$uname = "";
$pword = "";
$errorMessage = "";

//==========================================
//  ESCAPE DANGEROUS SQL CHARACTERS
//==========================================
function quote_smart($value, $handle) {
   if (get_magic_quotes_gpc()) {
   $value = stripslashes($value);
   }
   if (!is_numeric($value)) {
   $value = "'" . mysql_real_escape_string($value, $handle) . "'";
   }
   return $value;
}

if ($_SERVER['REQUEST_METHOD'] == 'POST'){
$uname = $_POST['username'];
$pword = $_POST['password'];

$uname = htmlspecialchars($uname);
$pword = htmlspecialchars($pword);

//==========================================
//  CONNECT TO THE LOCAL DATABASE
//==========================================
$user_name = "root";
$pass_word = "Newpass123#";
$database = "seatmapping";
$server = "localhost";

$db_handle = mysql_connect($server, $user_name, $pass_word);
$db_found = mysql_select_db($database, $db_handle);

if ($db_found) {
    $uname = quote_smart($uname, $db_handle);
    $pword = quote_smart($pword, $db_handle);

    $SQL = "SELECT * FROM userauth WHERE username = $uname AND pswd = md5($pword)";
    $result = mysql_query($SQL);
    $username = $_SESSION['username'];
    $num_rows = mysql_num_rows($result);

//====================================================
//  CHECK TO SEE IF THE $result VARIABLE IS TRUE
//====================================================

    if ($result) {
        if ($num_rows > 0) {
            session_start();
            $_SESSION['login'] = "1";
            header ("Location: main.php");
        }
        else {
            $errorMessage = "Invalid username/password.";
        }   
    }
    else {
        $errorMessage = "Error logging on.";
    }

mysql_close($db_handle);
}

else {
    $errorMessage = "Error logging on.";
}
}
?>

In here is an ajax script that should display the edit button when user "admin" is logged in. I can't get it to work though. PLeas any help is appreciated. Thank you in advance.

<?php
session_start();

$q = intval($_GET['q']);

$con = mysql_connect('localhost','root','Newpass123#','seatmapping');    
if (!$con){
    die('Could not connect: ' . mysql_error());
    }

mysql_select_db('seatmapping');
$sql="SELECT name, seatid FROM seats WHERE seatid = ".$q;
$result = mysql_query($sql) or die("Query Error " . mysql_error()); 

echo "<table class='box'>
<tr>
<th>Name</th>
<th>Seat Number</th>
</tr>";
while($row = mysql_fetch_array($result))
{
    echo "<tr>";
    echo "<td>" . $row['name'] . "</td>";
    echo "<td>" . $row['seatid'] . "</td>";

    if ($_SESSION['username'] == 'admin'){
        echo "<td><a>Edit</a></td>";
    }

    echo "</tr>";
    }
echo "</table>";

mysql_close($con);
?> 

If there still something lacking in the question or the code feel free to say so. :)

Answer 1

Instead of $_SESSION['username'] ,
You should use $uname for checking the Username and include first file into second file on top like:

include 'filename.php';

Answer 2

add different section for admin users
like $_SESSION['admin_user']
then check admin section active or not;
if active display edit button