Verifying user banned or not PHP?

Question

This is my login.php code. User is logged in even "status" is set to "yes". How can I verify if the user is banned and can I add more statuses like "suspend", "deactivated"?

session_start(); // Starting Session
$error=''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
  if (empty($_POST['username']) || empty($_POST['password'])) {
    $error = "Username or Password is invalid";
  } else {
    // Define $username and $password
    $username=$_POST['username'];
    $password=$_POST['password'];

    // Establishing Connection with Server by passing server_name, user_id and password as a parameter
    $connection = mysql_connect("localhost", "root", "");

    // To protect MySQL injection for Security purpose
    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);

    // Selecting Database
    $db = mysql_select_db("DBname", $connection);

    // SQL query to fetch information of registerd users and finds user match.
    $query = mysql_query("select * from users where password='$password' AND username='$username' AND", $connection);
    $rows = mysql_num_rows($query);

    if($row[‘status’]==’yes’){
      header("banned.php");
    } else if ($rows == 1) {
      $_SESSION['login_user']=$username; // Initializing Session
      $sql = mysql_query("INSERT INTO logs (`uniqueId`, `fileAccessed`, `action`, `userIp`, `userPort`, `serverIp`, `fullPath`, `protocol`, `serverVersion`, `timestamp`) VALUES ('$username', '$filename', 'Logged In', '$usrip', '$usrport', '$servip', '$scriptpath', '$servprotocol', '$servver', '$timestamp')", $connection);
      header("location: ../pages/profile.php"); // Redirecting To Other Page
    } else {
      $error = "Username or Password is invalid";
    }
    mysql_close($connection); // Closing Connection
  }
}

Answer 1

Firstly don't use mySQL anymore, it is deprecated and insecure. You should look into using mySQLi or PDO instead.

The problem you are having is because $row has no value.

You are missing:

$row = mysql_fetch_assoc($result) 

So it would read like this:

$query = mysql_query("select * from users where password='$password' AND username='$username' AND", $connection);
$rows = mysql_num_rows($query);
$row = mysql_fetch_assoc($result); 


    if($row[‘status’]==’yes’){
header("banned.php");
    }

Here it is rewritten as mySQLi, use this version instead and research the difference:

session_start(); // Starting Session
$error=''; // Variable To Store Error Message
if (isset($_POST['submit'])) {
  if (empty($_POST['username']) || empty($_POST['password'])) {
    $error = "Username or Password is invalid";
  } else {
    // Define $username and $password
    $username=$_POST['username'];
    $password=$_POST['password'];

    // Establishing Connection with Server by passing server_name, user_id and password as a parameter
    $connection = mysqli_connect("localhost", "root", "");

    // To protect MySQL injection for Security purpose
    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysqli_real_escape_string($username);
    $password = mysqli_real_escape_string($password);

    // Selecting Database
    $db = mysqli_select_db($connection, "DBname");

    // SQL query to fetch information of registerd users and finds user match.
    $query = "select * from users where password='$password' AND username='$username'";
    $result = mysqli_query($connection, $query);
    $row = mysqli_fetch_assoc($result); 
    $rows = mysql_num_rows($query);

    if($row[‘status’]==’yes’){
      header("banned.php");
    } else if ($rows == 1) {
      $_SESSION['login_user']=$username; // Initializing Session

      $query = "INSERT INTO logs (`uniqueId`, `fileAccessed`, `action`, `userIp`, `userPort`, `serverIp`, `fullPath`, `protocol`, `serverVersion`, `timestamp`) VALUES ('$username', '$filename', 'Logged In', '$usrip', '$usrport', '$servip', '$scriptpath', '$servprotocol', '$servver', '$timestamp')";

     $result = mysqli_query($connection, $query);

      header("location: ../pages/profile.php"); // Redirecting To Other Page
    } else {
      $error = "Username or Password is invalid";
    }
    mysqli_close($connection); // Closing Connection
  }
}