使用Access用户级别登录PHP

Question

i want to login page with access user level and with status (if user is active or Not) check.php page

<?php
require_once("db.php");

function check_input($r){
    $r=trim($r);
    $r=strip_tags($r);
    $r=stripslashes($r);
    return $r;
}

function get_salt($uid){
    $db=get_db();
    $stmt=$db->prepare("SELECT salt FROM login_details WHERE emp_id=?");
    $stmt->execute(array($uid));
    $r=$stmt->fetch(PDO::FETCH_ASSOC);
    return $r['salt'];
}

if (isset($_POST['uname'],$_POST['pwd'])){
    $u=check_input($_POST['uname']);
    $p=check_input($_POST['pwd']);
    $saltedpassword=md5(get_salt($uid).$p);
    try{
        $db=get_db();
        $stmt=$db->prepare("SELECT * FROM login_details WHERE emp_id=? && password=?");
        $stmt->execute(array($u,$saltedpassword));
        $r=$stmt->fetch(PDO::FETCH_ASSOC);
        if($r){
            if($r['status']=='1'){
                session_start();
                $access_level=$r['access_level'];
                $_SESSION['emp_id']=$r['emp_id'];
                $_SESSION['access_level']=$access_level;

                if ($access_level==0){
                    header("Location:emppages/");
                }
                if($access_level==1){
                    header("Location:hrpages/");
                }
                if($access_level==2){
                    header("Location:adpages/");
                }
            }else{
                header("Location:index.php?err=1");
            }
        }
    }catch(PDOException $e){
        die("Database error: ".$e->getMessage());
    }
}else{
    header("Location:index.php");
}
?>

my code is working correct when user enter correct password but if user enter wrong password is not working its stuck on check.php page.please correct my code if there is an error

Answer 1

I think you need to move the else outside if ($r['status']=='1') block.

if($r){
    if($r['status']=='1'){
        session_start();
        $access_level=$r['access_level'];
        $_SESSION['emp_id']=$r['emp_id'];
        $_SESSION['access_level']=$access_level;

        if ($access_level==0){
            header("Location:emppages/");
        }
        if($access_level==1){
            header("Location:hrpages/");
        }
        if($access_level==2){
            header("Location:adpages/");
        }
    }
    else{
        header("Location:index.php?err=4");
    }
} else{
    header("Location:index.php?err=1");
}

Answer 2

Some things to consider. Not a direct answer to the problem, but it will help you clean things out and most likely fix your problem or make it easier to find.

It's good practice to exit after doing a header redirect (and some times absolutely needed)

header("Location: /something"); 
exit;

Why not use PHP's password_hash()/password_verify ? Much more easy.

Create user :

$username = isset($_POST['username']) ? trim($_POST['username']) : null;
$password = isset($_POST['password']) ? trim($_POST['password']) : null;

if(!empty($username) && !empty($password)){

    $hash = password_hash($password, PASSWORD_DEFAULT); 
   // Store in Database etc...

}

Login user:

$username = isset($_POST['username']) ? trim($_POST['username']) : null;
$password = isset($_POST['password']) ? trim($_POST['password']) : null;

if(!empty($username) && !empty($password)){

    // Do DB query getting the username's password

    $hashedPassword = $QueryResult->password;

    if(password_verify($password, $hashedPassword){
        // Success - check user level and status etc
    }else{
        // Failed
    }

}