PHP：检查管理员是否登录，重定向他们并确保正确的访问

Question

I have a page for users named game.php, where they can update their profile etc. So when the admin logs in, they can still access game.php but I do not want them to do so. How do I prevent it?

I have 2 different log in page, 1 for normal users (logreg.php), 1 for admin (admin.php)

This is my game.php codes, where they restricts the admin from accessing and it redirects me back to logreg.php.

The status of the user will be "gamer" - a normal user OR "admin" - for admin log in.

<?php 
session_start(); 
ob_start(); 

if (!isset($_SESSION["username"], $_SESSION['status'])) {
    $_SESSION['username'] = $username;
    $_SESSION['status'] = 'admin';
        header("Location:logreg.php");
    }
 else {
    $username = $_SESSION['username'];
    }
?> 

But here's the issue: how do I check if the user is logged in as admin at the admin.php (admin login page) and redirect them to the admin site instead of logging in again, while also making sure that the "gamers" can't access the admin site? It states that my site has redirected me too many times.

Here are my codes for admin.php

<?php 
session_start(); 
ob_start(); 

if (!isset($_SESSION["username"], $_SESSION['status'])) {
    $_SESSION['username'] = $username;
    $_SESSION['status'] = 'gamer';
        header("Location:admin.php");
    }
 else {
    $username = $_SESSION['username'];
    $_SESSION['status'] = 'admin';
    header("Location:adminpage.php");
    }
?> 

Thanks in advance!!!!

Answer 1

Too long for a comment but a code-free answer...

Actually, I think what you want is to have a single login.php page, which processes the user login. On that page, first ensure username/password match. Then look up rights level to see if they are an admin or a player (or something else in the future?). Set a session variable to indicated user is authenticated and a user rights level - admin or player (this gives future flexibility to add "moderator", etc)

On admin.php check the session to see that the user is authenticated, and the user has admin rights. If they don't then unset all the session variables and redirect to the home page or login page. If you want to be nice, before doing that check to see if they are an authenticated user and if so redirect to game.php instead.

On game.php check the session to see that the user is authenticated, and the user does not have admin rights. If they do have admin rights, print a message reminding that admins can't play while logged in as admins, and provide a link to admin.php and logout.php (which will unset all session vars and redirect to login.php ). Then check to make sure you have an authenticated gamer, if not then bounce to the logout.php (and again back to login.php ) also.