如何确保用户类型=“ admin”只能访问某个网页？ PHP的MySQL

Question

How do I make sure that only users with type="admin" can access for example admin.php

for example. I am logged out. but i can still access the admin.php, how to I make sure i can only access the page when i am logged in as an admin?

if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"


    while($row = mysql_fetch_array($result)){
        //remove this line ******header("location:customer_home.php");
        if($row['type'] == 'admin'){
            header("location: admin.php");
        } else if($row['type'] == 'customer'){
            header("location: customer_home.php");
        }
    }
}

Thank you so much.

Answer 1

The simplest solution is

if($row['type'] == 'admin'){
    $_SESSION['isAdmin'] = true;
        header("location: admin.php");
    }

And the on your admin.php file:

if($_SESSION['isAdmin']==true){

    print 'hi admin!';

}

However this is a 'basic' version, and I would suggest looking up PHP security, and looking up the users logged in ID with a table within your database to properly check the users logged in credentials.