Query Not Returning All Data

Question

i have created Lead Management System. i have created to type of user category as given below

1. user - Normal user of System who can see only his/her data while logged in system
2. admin - treating as manager login in which manager can see all data of user which has been register under his/her name

Function:-

i have created on function in which im checking weather logged in user is 'logged_in_as' as admin or user. Coder give below

function logged_in_as() {
    return (mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `user` WHERE `user_type` = 'admin'"), 0) == 1) ? true : false;
}

Query :-

Now by using this function i am trying to pull out the data according to query given below.

if(logged_in_as() === false) {
    $sql = mysql_query("SELECT * FROM `lead_table` WHERE `created_by` = $session_user_id");
    } else {
    $sql = mysql_query("SELECT * FROM `lead_table`");
    }
    $hotelcount = mysql_num_rows($sql);
    if($hotelcount > 0) {
        while($row = mysql_fetch_array($sql)) {
        $id             = $row['customer_id'];
        $pic            = $row['client_name'];
        $country        = $row['city'];
        $destination    = $row['contact_person'];
        $price          = $row['email_id'];
        $mobile         = $row['mobile'];
        $lead_id        = $row['lead_id'];
        $dynamiclist    .= '<tbody>
                                <tr class="yahoo">
                                    <td>' . $id . '</td>
                                    <td>' . $pic . '</td>
                                    <td class="hidden-phone">' . $country . '</td>
                                    <td class="hidden-phone">' . $destination . '</td>
                                    <td class="hidden-phone">'. $price . '</td>
                                    <td>'. $mobile .'</td>
                                    <td>Trident</td>
                                    <td><a href="edit.php?mode=update&lead_id='. $lead_id   .'">Edit</a> / <a href="updatelead.php?lead_id='. $lead_id  .'">Update</a></td>
                                </tr>
                            </tbody>';
    }
    } else {
        $dynamiclist = 'We Do Not Have Any Hotel Listed in This City';
    }

Error:-

When i am logged in as 'user' query is returning only the data which has been entered by the user but when i am logged in as admin query is not returning any data which has been entered by register user under that admin.

Please Help !!!

Answer 1

Check whether logged_in_as() returns the proper bool value. Maybe u have a bug in that function and it always returns false.

Since it is false, it will return all the leads entered by that user (ie admin), and since admin has not entered any data, it shows blank.

This is only a guess. It should work otherwise, your code is apparently OK.

Let me know what returns by the logged_in_as() function for further support.

Answer 2

Just on a side note, why not save the usergroup (admin or normal user) to a session instead of running that function all the time when checking who is and isn't a system admin? Potentially you would run that sql routine many times on a page just to check the usergroup which seems a bit much. At that juncture it would check like so:

if(isset($_SESSION['usergroup']) && $_SESSION['usergroup'] == 'admin') {
    // Do your code thang...
}

You would only run an sql userid check at login. Maybe your system doesn't have heavy traffic and it doesn't bog you down, but that just seems like a lot of sql just to keep checking usergroup. Also the comment about the deprecated mysql_query is true, you should switch over to PDO or mysqli calls.

Answer 3

I hope I am mistaken but does your logged_in_as() method even works? It doesn't even seems to have an input.

As long as your user table contains at least 1 admin it'll always return true.

try this and see if it helps

function logged_in_as() {
    return (mysql_result(mysql_query("SELECT if(user_type='admin',1,0) FROM `user` WHERE `user_id` = $session_user_id"), 0) == 1) ? true : false;
}