check the log in if user or admin with php

Question

I'm trying to check if the one who logged in is user or admin, I created a column in my DB named 'pin' and put the value whether 0 or 1. if the pin in 0 so the logged in is an admin and user otherwise. here is my code but it didn't work with me, please help, I'm totally beginner

$query = mysql_query("SELECT ID, password FROM facultymember ".
    "WHERE password='$password' AND ID='$ID'", $connection);
$query2 = mysql_query("SELECT pin FROM facultymember ".
    "WHERE password='$password' AND ID='$ID'", $connection);
$row2 = mysql_fetch_assoc($query2);
$check = $row2['pin'];
$rows = mysql_num_rows($query);
if ($rows == 1 && $check == 1) {
    $_SESSION['login_user']=$ID; // Initializing Session
    header("location: homeFM.php"); // Redirecting To Other Page

}
else if($rows == 1 && $check == 0) {
    $_SESSION['login_user']=$ID; // Initializing Session
    header("location: homeA.php"); // Redirecting To Other Page
} else {
    $error = "Username or Password is invalid";
}
mysql_close($connection); // Closing Connection
}

the page of homeFM.php opens on each situation, for admin and user — Afnan Humdan, Mar 10 '16 at 17:17
Why don't you query for the `pin` with the first query? Why run a completely different one? — Jon, Mar 10 '16 at 17:22
You don't need to select the `ID, password` you already have that because they are the variables. Passwords should be hashed, hopefully these values have been sanatized. — chris85, Mar 10 '16 at 17:27
[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) — Jay Blanchard, Mar 10 '16 at 20:12
Please [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). [These extensions](http://php.net/manual/en/migration70.removed-exts-sapis.php) have been removed in PHP 7. Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) and consider using PDO, [it's really pretty easy](http://jayblanchard.net/demystifying_php_pdo.html). — Jay Blanchard, Mar 10 '16 at 20:13

Jon · Accepted Answer · 2016-03-10T18:06:35.653

1

Ok, so i rewrote what you have to try and make sense of it for you, with comments.

$query = mysql_query("SELECT ID, password, pin FROM facultymember ".
    "WHERE password='$password' AND ID='$ID'", $connection);

$row = mysql_fetch_assoc($query);

if(false != $row){ // user info exists/correct
    $_SESSION['login_user'] = $row['ID'];
    if('1' == $row['pin']) { //not admin    
        header("location: homeFM.php"); // Redirecting To Other Page
        die;
    } else { //admin
        header("location: homeA.php"); // Redirecting To Other Page
        die;
    }
} else { //login doesn't exist
    $error = "Username or Password is invalid";
}

mysql_close($connection); // Closing Connection

And that should work for you, hopefully the comments explain it. If it doesn't work, let me know, but it should according to the info you provided.

That being said....

I hope that your passwords are hashed, the input is sanitized, and that you look in to using PDO or MySQLi classes instead of the old deprecated mysql_ functions.

As a side note session_start(); is needed to start a session, not just assigning a variable within the super-global.

edited Mar 10 '16 at 18:06

answered Mar 10 '16 at 17:37

Jon

4,746
2
24
37

I really appreciate your answer, but it didn't work actually – Afnan Humdan Mar 10 '16 at 17:49
Then I need more information to help. Can you give some actual data from the database? When you say "it doesn't work" what do you mean? – Jon Mar 10 '16 at 17:50
the page isn't working at all – Afnan Humdan Mar 10 '16 at 17:50
(I did remove the extra curly brace for my answer, you would need to put it back in for your code.) – Jon Mar 10 '16 at 17:50
yes i did that, still the page isn't working – Afnan Humdan Mar 10 '16 at 17:51
No one can help you based on "it isn't working" You need to give more information than that for anyone helping to go on. – Jon Mar 10 '16 at 17:52
sorry, the page is working but the page homeFM.php shows for both admin and user – Afnan Humdan Mar 10 '16 at 17:53
Have you checked the database to make sure admin has a `0` for their `pin` field? – Jon Mar 10 '16 at 17:54
yes I'm pretty sure of this – Afnan Humdan Mar 10 '16 at 17:54
Might want to re-check your database, as that is the only thing that can be going wrong according to what you have said. ^^ – Jon Mar 10 '16 at 17:55
I just checked it, it's 1 for user and 0 for admin, Thank you Jon anyway – Afnan Humdan Mar 10 '16 at 17:58
After `mysql_fetch_assoc`, do a `var_dump($row); die;` and see what it shows. – Jon Mar 10 '16 at 18:00
sorry but I'm a beginner and I don't know how to write it – Afnan Humdan Mar 10 '16 at 18:01
Right after `$row = mysql_fetch_assoc($query);` put a new line with `var_dump($row);die;` – Jon Mar 10 '16 at 18:02
array(3) { ["ID"]=> string(4) "1111" ["password"]=> string(5) "12345" ["pin"]=> string(1) "1" } – Afnan Humdan Mar 10 '16 at 18:03
Is that for the user or admin? Try it with the admin one and see what you get. – Jon Mar 10 '16 at 18:03
the above is for user, this for admin: array(3) { ["ID"]=> string(4) "2222" ["password"]=> string(4) "1212" ["pin"]=> string(1) "0" } – Afnan Humdan Mar 10 '16 at 18:04
Updated my answer to remove unneeded middle variable, and type of comparison. Try it again? – Jon Mar 10 '16 at 18:07
Thaaaaaaaank you *_* – Afnan Humdan Mar 10 '16 at 18:08

Adam Hull · Answer 2 · 2016-03-10T17:31:39.027

0

Error: There is 1 more closing curly braces '}' found

I'm guessing it is the last curly brace that needs removing

$query = mysql_query("SELECT ID, password FROM facultymember  WHERE password='".$password."' AND ID=".$ID, $connection);

$query2 = mysql_query("SELECT pin FROM facultymember WHERE password='".$password."' AND ID=".$ID, $connection);

Your querys had weird concatenation

edited Mar 10 '16 at 17:31

answered Mar 10 '16 at 17:20

Adam Hull

214
1
8

this brace if for other statement above which i didn't copy – Afnan Humdan Mar 10 '16 at 17:22
your edit caused a problem, the page isn't working anymore – Afnan Humdan Mar 10 '16 at 17:29
Oops my mistake should work now – Adam Hull Mar 10 '16 at 17:32

check the log in if user or admin with php

2 Answers2