如何修复未以PHP PDO中指定角色身份登录的用户

Question

I have three user roles. The roles are Admin, Student and Lecturer. I already set each role to echo out different things. However, when I login as a Student, I will be logged in as the most recent user in the session. Eg: Previously I login as the lecturer before I tweaked the PDO code. After I tweaked the code, I tried to login as a student but I am still logged in as the lecturer role.

I do not think that this is the session problem because I already unset the session and destroy the session when I log out.

Here are my codes:- Code in Navbar.php

<?php
    $user_id = $_SESSION['user_id'];

    // Database connection
    require_once('classes/PDOConnection.class.php');
    $db = PDOConnection::getConnection(); // connect to db

    // Retrieve the columns from the database
    $sql = "SELECT username, fname, lname, role FROM users";        

    $stmt = $db->prepare($sql);
    if ($stmt->execute(array($_SESSION['user_id'])))
    {
        while($row = $stmt->fetch()) 
        {
           //fetch the rows
            $username = $row['username'];
            $fname = $row['fname'];
            $lname = $row['lname'];
            $role = $row['role'];
        }
    }

    echo 
    "
        <!-- Main Header -->
        <header class='main-header'>

        <!-- Logo -->
        <a href='dashboard.php' class='logo'>
            <!-- mini logo for sidebar mini 50x50 pixels -->
            <span class='logo-mini'><i class='fa fa-address-book'></i></span>
            <!-- logo for regular state and mobile devices -->
            <span class='logo-lg'><b>STULEC</b></span>
        </a>

        <!-- Header Navbar -->
        <nav class='navbar navbar-static-top' role='navigation'>
            <!-- Sidebar toggle button-->
            <a href='#' class='sidebar-toggle' data-toggle='push-menu' role='button'>
            <span class='sr-only'>Toggle navigation</span>
            </a>
            <!-- Navbar Right Menu -->
            <div class='navbar-custom-menu'>
            <ul class='nav navbar-nav'>
                <!-- Messages: style can be found in dropdown.less-->
                <li class='dropdown messages-menu'>
                <!-- Menu toggle button -->
                <a href='#' class='dropdown-toggle' data-toggle='dropdown'>
                    <i class='fa fa-envelope-o'></i>
                    <span class='label label-success'>4</span>
                </a>
                <ul class='dropdown-menu'>
                    <li class='header'>You have 4 messages</li>
                    <li>
                    <!-- inner menu: contains the messages -->
                    <ul class='menu'>
                        <li><!-- start message -->
                        <a href='#'>
                            <div class='pull-left'>
                            <!-- User Image -->
                            <img src='dist/img/user2-160x160.jpg' class='img-circle' alt='User Image'>
                            </div>
                            <!-- Message title and timestamp -->
                            <h4>
                            Support Team
                            <small><i class='fa fa-clock-o'></i> 5 mins</small>
                            </h4>
                            <!-- The message -->
                            <p>Why not buy a new awesome theme?</p>
                        </a>
                        </li>
                        <!-- end message -->
                    </ul>
                    <!-- /.menu -->
                    </li>
                    <li class='footer'><a href='#'>See All Messages</a></li>
                </ul>
                </li>
                <!-- /.messages-menu -->

                <!-- Notifications Menu -->
                <li class='dropdown notifications-menu'>
                <!-- Menu toggle button -->
                <a href='#' class='dropdown-toggle' data-toggle='dropdown'>
                    <i class='fa fa-bell-o'></i>
                    <span class='label label-warning'>10</span>
                </a>
                <ul class='dropdown-menu'>
                    <li class='header'>You have 10 notifications</li>
                    <li>
                    <!-- Inner Menu: contains the notifications -->
                    <ul class='menu'>
                        <li><!-- start notification -->
                        <a href='#'>
                            <i class='fa fa-users text-aqua'></i> 5 new members joined today
                        </a>
                        </li>
                        <!-- end notification -->
                    </ul>
                    </li>
                    <li class='footer'><a href='#'>View all</a></li>
                </ul>
                </li>

                <!-- User Account Menu -->
                <li class='dropdown user user-menu'>
    ";                


if  ($row['role'] == "Student")
{
    echo
    "
                    <!-- Menu Toggle Button -->
                    <a href='#' class='dropdown-toggle' data-toggle='dropdown'>
                        <!-- The user image in the navbar-->
                        <img src='dist/img/user2-160x160.jpg' class='user-image' alt='User Image'>
                        <!-- hidden-xs hides the username on small devices so only the image appears. -->
                        <span class='hidden-xs'>" . $fname . "</span>
                    </a>
                    <ul class='dropdown-menu'>
                        <!-- The user image in the menu -->
                        <li class='user-header'>
                        <img src='dist/img/user2-160x160.jpg' class='img-circle' alt='User Image'>
                    <p>
                    " . $fname . ' ' . $lname ."
                        <small>Student ID: " . $username . " </small>
                    </p>
                </li>    
    ";
}
elseif ($row['role'] == "Lecturer")
{   echo
    "
                    <!-- Menu Toggle Button -->
                    <a href='#' class='dropdown-toggle' data-toggle='dropdown'>
                        <!-- The user image in the navbar-->
                        <img src='dist/img/user2-160x160.jpg' class='user-image' alt='User Image'>
                        <!-- hidden-xs hides the username on small devices so only the image appears. -->
                        <span class='hidden-xs'>" . $fname . "</span>
                    </a>
                    <ul class='dropdown-menu'>
                        <!-- The user image in the menu -->
                        <li class='user-header'>
                        <img src='dist/img/user2-160x160.jpg' class='img-circle' alt='User Image'>
                    <p>
                    " . $fname . ' ' . $lname ."
                        <small>Lecturer ID: " . $username . " </small>
                    </p>
                </li>    
    ";
}
else
{
    echo
    "
                    <!-- Menu Toggle Button -->
                    <a href='#' class='dropdown-toggle' data-toggle='dropdown'>
                        <!-- The user image in the navbar-->
                        <img src='dist/img/user2-160x160.jpg' class='user-image' alt='User Image'>
                        <!-- hidden-xs hides the username on small devices so only the image appears. -->
                        <span class='hidden-xs'>" . $fname . "</span>
                    </a>
                    <ul class='dropdown-menu'>
                        <!-- The user image in the menu -->
                        <li class='user-header'>
                        <img src='dist/img/user2-160x160.jpg' class='img-circle' alt='User Image'>
                    <p>
                   " . $fname . ' ' . $lname ."
                        <small>Admin ID: " . $username . " </small>
                    </p>
                </li>
    ";

}                    

    echo 
    "                
                    <!-- Menu Footer-->
                    <li class='user-footer'>
                    <div align='center'>
                        <a href='edit-profile.php' class='btn btn-default btn-flat'>Profile</a>
                    </div>
                    </li>
                </ul>
                </li>
                <!-- Sign Out Button -->
                <li>
                <a href='logout.php'><i class='fa fa-sign-out'></i></i></a>
                </li>
            </ul>
            </div>
        </nav>
        </header>
    ";
?>

Code in login.php

<?php
// Database connection
require_once ('classes/PDOConnection.class.php');
$db = PDOConnection::getConnection(); // connect to db

// Start Session
session_start();

// Application library ( with DemoLib class )
require __DIR__ . '/lib/library.php';
$app = new DemoLib();

$login_error_message = '';

// check Login request
if (!empty($_POST['btnLogin'])) 
{
  $username = trim($_POST['username']);
  $password = trim($_POST['password']);

  if ($username == "") 
  {
    $login_error_message = 'Username field is required!';
  } 
  else if ($password == "") 
  {
    $login_error_message = 'Password field is required!';
  } 
  else 
  {
    $user_id = $app->Login($username, $password); // check user login

    if($user_id > 0)
    {
      $_SESSION['user_id'] = $user_id; // Set Session
      header("Location: dashboard.php"); // Redirect user to the profile.php
    }
    else
    {
      $login_error_message = 'Invalid login details!';
    }
  }
}
?>

Code in library.php

public function Login($username, $password)
        {
            try 
            {
                $db = PDOConnection::getConnection(); // connect to db
                $query = $db->prepare("SELECT user_id, role FROM users WHERE (username=:username) AND password=:password");
                $query->bindParam("username", $username, PDO::PARAM_STR);
                $enc_password = hash('md5', $password);
                $query->bindParam("password", $enc_password, PDO::PARAM_STR);
                $query->execute();
                if ($query->rowCount() > 0) 
                {
                    $result = $query->fetch(PDO::FETCH_OBJ);
                    $_SESSION['role'] = $result->role;
                    return $result->user_id;
                } 
                else 
                {
                    return false;
                }
            } 
            catch (PDOException $e) 
            {
                exit($e->getMessage());
            }
        }

Code in logout.php

<?php
// start session
session_start();

// remove all session variable
unset($_SESSION['user_id']);

// destroy the session
session_destroy(); 

// Redirect to index.php page
header("Location: index.php");
?>

Here is my database design for the users table

Answer 1

Your SELECT statement in Navbar.php retrieves the entire table. There is no selection based on WHERE user_id = :userid