I started out in web programming with little to no training, and certainly no teachers to guide me. It can be a little more difficult to learn than a lot of people will let on once they've already gotten the hang of where to look for answers and how to read the documentation.
First of all, please, please, please, use the mysqli functions rather than the mysql ones. This extension was updated for a reason. Or, even better, use PDO or another such adapter so that your code will be both more secure and easier to write and maintain later, if you ever do decide to go beyond this one assignment.
Also, parameterized queries! It will do you a world of good to start using them now and forget about mysql_real_escape_string.
Second, please look up why using md5 hashes for password storage is a bad idea. Even for an assignment like this, you should get in the practice of using secure and standard coding approaches so that you will develop good habits as you move forward.
I have removed the usage of your 'connection.php' file and have made several assumptions about the structure of your database in order to provide you with a working code fragment. There are many areas that you could optimize and improve on with the code below, but it does achieve the desired results.
<?php
session_start();
//make sure you never do this in production
//you should store your connection usernames and passwords outside the web root
//to make unintentional disclosure of them harder
$mysqli = new mysqli( 'localhost', 'username', 'password', 'dpuploaden' );
if( mysqli_connect_errno() ){
//in real production code, this would be insecure as you shouldn't give away error information
//that could allow an attacker to gain more knowledge about your systems if at all possible
exit( printf( "Kan geen verbinding met de database: %s\n", mysqli_connect_error() ) );
}
if( isset( $_POST[ 'btn-login' ] ) ){
$email = $_POST[ 'email' ];
$upass = $_POST[ 'pass' ];
$id = NULL;
$password = NULL;
$soortgebruiker = NULL;
if( $stmt = $mysqli->prepare( 'SELECT `gebruiker_id`, `password`, `soortgebruiker` FROM `tblgebruikers` WHERE `email` = ?' ) ){
$stmt->bind_param( 's', $email );
$stmt->execute();
$stmt->bind_result( $id, $password, $soortgebruiker );
$stmt->fetch();
$stmt->close();
//please do not ever use md5 has a password hashing solution in real code
//look up the php function password_hash, or if you have PHP < 5.5.0 bcrypt
//for their proper usage, or better yet, seek out a library that implements
//this kind of login code and just use it
//roll your own is always a bad idea when it comes to security and, even with
//a lot of experience and information under your belt, it is all too easy to make mistakes
if( $row[ 'password' ] === md5( $upass ) ){
$_SESSION[ 'user' ] = $id;
$_SESSION[ 'soortgebruiker' ] = $soortgebruiker;
}
else
exit( "Foute gegevens. Probeer opnieuw." );
}
else{
exit( 'Fout retrieveing informatie.' );
}
}
if( isset( $_SESSION[ 'user' ] ) && $_SESSION[ 'user' ] != '' ){
if( $_SESSION[ 'soortgebruiker' ] === 'student' ){
header( "Location: index.php" );
exit;
}
else if( $_SESSION[ 'soortgebruiker' ] === 'docent' ){
header( "Location: index2.php" );
exit;
}
}
//output login page here
?>
