How to set user/admin accounts for a redirect after log in? PHP

Question

My problem with this code is that the IF statement which is deciding what page to go to seems to default to index.php. I have made a login table in MySQL already and have username/password column, and another column with a boolean value which states if the user is admin.

session_start(); // Starting Session
$error = ''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
    if (empty($_POST['username']) || empty($_POST['password'])) {
        $error = "Username or Password is invalid";
    } else {
// Define $username and $password
        $username = $_POST['username'];
        $password = $_POST['password'];

// Establishing Connection with Server by passing server_name, user_id and password as a parameter
        $connection = mysql_connect(" ", " ", " ", " ");

// Selecting Database
        $db = mysql_select_db(" ", $connection);

// SQL query to fetch information of registerd users and finds user match.
        $query = "SELECT * FROM login WHERE username='$username' and password='$password'";
        $result = mysql_query($query) or die(mysql_error());
        $row = mysql_fetch_array($result);
        $count = mysql_num_rows($result);

        $auth = $row['admin'];
        if ($count == 1) {
            if ($auth['admin'] == 1) {
                session_start();
                $_SESSION['admin'] = $auth;
                $_SESSION['username'] = $username;
                header("location: member.php");
            } elseif ($auth['admin'] == 0) {
                session_start();
                $_SESSION['admin'] = $auth;
                header("location:index.php");
            }
        } else {
            $error = "Username or Password is invalid";
        }
        mysql_close($connection); // Closing Connection
    }
}

Answer 1

Since you already extracted your admin value here:

$auth=$row['admin'];

You don't have to extract it here:

if($auth['admin']==1){

or here:

elseif($auth['admin']==0){

This simple change should fix your problem:

if($auth==1) {
    ...
} elseif($auth==0) {
    ...

In your original code, $auth['admin'] doesn't exist because $auth itself is just an integer, so it will pass the $auth['admin'] == 0 test since it is "falsy."

Also, it looks like you may have a case where $auth is completely undefined, in which case you should use "strict comparison" for that second condition, so you're looking for an actual zero and not just anything falsy:

} elseif($auth===0) {

Answer 2

<?php
    session_start(); // Starting Session
    $error=''; // Variable To Store Error Message
    if (isset($_POST['submit'])) {
        if (empty($_POST['username']) || empty($_POST['password'])) {
            $error = "Username or Password is invalid";
        }
        else
        {
            // Define $username and $password
            $username=$_POST['username'];
            $password=$_POST['password'];

            // Establishing Connection with Server by passing server_name, user_id and password as a parameter
            $connection = mysql_connect(" ", " ", " ", " ");

            // Selecting Database
            $db = mysql_select_db(" ", $connection);

            // SQL query to fetch information of registerd users and finds user match.
            $query = "SELECT * FROM login WHERE username='$username' and password='$password'";
            $result=mysql_query($query) or die(mysql_error());
            $row= mysql_fetch_array($result);
            $count=mysql_num_rows($result);

            $auth= (int)$row['admin'];

            if($count){
                if($auth == 1){

                    $_SESSION['admin']= $auth;
                    $_SESSION['username']= $username;
                    header("location: member.php");
                    exit;
                }elseif($auth == 0){

                    $_SESSION['admin']= $auth;
                    header("location:index.php");
                    exit;
                }
            } else {
                $error = "Username or Password is invalid";
            }
            mysql_close($connection); // Closing Connection
        }
    }
    ?>

Answer 3

I re wrote your login script. Try this. I think you'll find this will work much better for what your doing.

if(isset($_POST['username'])) {
    $username = stripslashes($_POST['username']);
    $username = strip_tags($username);
    $username = mysql_real_escape_string($username);
    $password = $_POST['password'];
    //$password = md5($password);

$db_host = "host"; $db_username = "username"; $db_pass = "password"; $db_name = "db_name"; mysql_connect("$db_host","$db_username","$db_pass"); mysql_select_db("$db_name"); // connect to your database only if username is set

 $sql = mysql_query("SELECT * FROM login WHERE username='$username' and password='$password'");
 $login_check = mysql_num_rows($sql);
 if($login_check > 0){ // if the user exists run while loop below

session_start();  // start session here (only once)

while($row = mysql_fetch_array($sql)){ // fetch the users admin from query

    $auth = $row['admin'];
    $_SESSION['admin'] = $auth; // set admin session variable
    $_SESSION['username'] = $username; // set username session variable

    if($auth == 1){
        header("location: member.php"); // if user auth is 1, send to member
    }else if($auth == 0){
        header("location: index.php"); // if user auth is 0, send to index
    }

    exit();
}
} else {

header('Location: login.php'); // if user doesnt exist, reload login page.
}

mysql_close();

}

I recommend using md5 hash passwords.

When a person registers at your site, you can convert the password to md5 hash with this line $password = md5($password); prior to the db entry

Regarding your $auth above, this assumes your entry in the database is either a 0 or a 1. If you are controlling it this way, i recommend using enum in the sql database. set the type to "enum" and the type to '0', '1'

Answer 4

Try

header("Location: index.php");
exit;
header("Location: member.php");
exit;

Note the Capital L and the exit;

Also try if($auth == "1") and elseif($auth == "0") respectively.

If you value the security of your login page, use PDO or mysqli instead of mysql . It is deprecated and insecure due to its vulnerability to SQL injection.

Also, take advantage of PhP's password_hash and password_verify when handling storage and verification of passwords. It is a lot more secure compared to md5() . If you'd like examples of usage, let me know.