检查已登录用户的角色（PHP）

Question

first, I have searched for a question that is the same with mine, unfortunately I can't understand the answers. It says use Auth, etc... bla bla bla. I only know basics so far.

So here is my question: how to check the user currently logged in and its role?

I thought I could do it so easily, actually I did, but the user of the site I'm building should only be one. lol. I have two columns named session and membership. Anyway, my code is written below (It is definitely wrong, I just realized it this 2AM in the morning. It would 100% work if the user of the side is again only one.

    if(empty($_SESSION['user']))
    {
        // If they are not, we redirect them to the login page.


        // Remember that this die statement is absolutely critical.  Without it,
        // people can view your members-only content without logging in.
        header("Location: http://localhost/se/");
    }
    //if(!empty($_SESSION['user']) )
    else
    {
        //This following codes are for checking the session in DB
        $query = "
            SELECT
                id,
                password,
                emailAddress,
                membership
            FROM memberlist
            WHERE
                session = :var_val
        ";
        // The parameter values
        $query_params = array(
           ':var_val' => 'True'
        );      

        try
        {
            // Execute the query against the database
            $stmt = $db->prepare($query);
            $result = $stmt->execute($query_params);

        }
        catch(PDOException $ex)
        {
            // Note: On a production website, you should not output $ex->getMessage().
            // It may provide an attacker with helpful information about your code. 
            die("Failed to run query: " . $ex->getMessage());
        }
        $row = $stmt->fetch();



        if ( $row['membership'] == 'Officer'  || $row['membership'] == 'Member' )
        {
            header("Location: http://localhost/memberdir/index.php");
        }
}

If a user's membership == 1, then go to admin directory. else go to members directory.

Please help :(

Answer 1

when the user login success you can do like this:

if(login success)
{
   $_SESSION['user']=array('id'=>$id,
                'emailAddress'=>$emailAddress,
                'membership'=>$membership);//the three values are selected from database when login in
}else
{
    // do some thing 
}

then when you check the user ,you can use:

if(empty($_SESSION['user']))
    {
        // If they are not, we redirect them to the login page.


        // Remember that this die statement is absolutely critical.  Without it,
        // people can view your members-only content without logging in.
        header("Location: http://localhost/se/");
    }else
    {
        //get user info from session
    }

Answer 2

To start a user session:

session_start();

To add parameters to that session:

$_SESSION['parameter'] = $parameter;

To get that parameter:

$getParameter = $_SESSION['parameter'];

So make sure you put session_start(); before any output to the page (before you print anything):

 if ( $row['membership'] == 'Officer'  || $row['membership'] == 'Member' )
        {
            session_start();
            $_SESSION['membership'] = $row['membership'];
            include('memberdir/index.php'); 
            //or  header("Location: http://localhost/memberdir/index.php");
        }

So in your member file that you show a particular user (or only one user, doesn't make a difference), you check that the session parameter exists and what to do with it:

if (isset($_SESSION['membership'])) {
    //membership parameter is set
    if($_SESSION['membership'] == 'Officer') {
        echo "Hey, your membership is Officer, here is your page";
    } else if ($_SESSION['membership'] == 'Member') {
        echo "Hey your membership is Member, here is your page";
    }
}

This should help you understand the basics and you can go from there.