logging in as user or admin from 2 different tables

Question

okay so i wanna log in as user and admin, my user table is called "sollicitant" and my admin is "bedrijf" (this is dutch lol sorry). the code i have right now works for only 1 table but how can i have a sql query that looks in both tables to log in?

<?php
if(isset($_POST['email'])) {

    $inputEmail = htmlspecialchars($_POST['email']);
    $inputWachtwoord = htmlspecialchars($_POST['wachtwoord']);

    $servername   = "localhost";
    $databasename = "vacaturebank.";
    $username     = "root";
    $password     = "";

    try {
        $conn = new PDO("mysql:host=$servername; dbname=$databasename", $username, $password);

        $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

    } catch(PDOException $e) {
        echo "Connection failed: " . $e->getMessage();
        return;
    }

    try {
        $stmt = $conn->prepare("SELECT * FROM sollicitant WHERE email = '$inputEmail'");
        $stmt->execute();

        $result = $stmt->setFetchMode(PDO::FETCH_ASSOC);
        $row    = $stmt->fetch();

        $rowCount = $stmt->rowCount();

        if ($rowCount) {

            if ($inputWachtwoord == $row['wachtwoord']) echo "<br/>Successvol ingelogd";
            else                                    echo "<br/>Gebruikersnaam en wachtwoord komen niet overeen.";
            header("Location: inloggen.html");
        } else {
            echo "<br/>Login failed, no record found";
        }
    }
    catch(PDOException $e) {
        echo "Error: " . $e->getMessage();
    }

    $conn = null;

    session_start();

    $_SESSION["login"] = true;
    $_SESSION["email"] = $inputEmail;

}
?>

Answer 1

You need to specify both tables with the email column:

SELECT * 
FROM sollicitant, bedrijf 
WHERE sollicitant.email = '$inputEmail' 
AND bedrijf.email = '$inputEmail'

Another possibility is using an explicit JOIN with alias' (The alias' are just for shortening things up, you do not have to use them.):

SELECT *
FROM sollicitant s, bedrijf b
ON s.email = b.email
WHERE s.email = '$inputEmail' 

Doing this means you only have to account for the eamil in one column of one table as the JOIN makes sure you only get those rows having a matching email. If the query is empty the email does not exist in both.

Edit

If you want to decide where to go based on a user's role you should consolidate all users into one table having a column that delineates the user's role:

SELECT * FROM users WHERE email = '$inputEmail' 

Then the PHP once you have fetched the data:

if('sollicitant' == $row['role']) {
    header('Location: sollicitant.php');
    exit();
} elseif ('bedrijf' == $row['role']) {
    header('Location: befrijf.php');
    exit();
} else {
    echo 'There is a problem with your login.';
}        

Warning!

...as others have said...

Little Bobby says your script is at risk for SQL Injection Attacks.. Even escaping the string is not safe!

I hate when people say "I'm not that far along..." or "This site will not be public..." or "It's only for school, so security doesn't matter...". If teachers and professors are not talking about security from day one, they're doing it wrong. Challenge them. They're teaching sloppy and dangerous coding practices which students will have to unlearn later. I also hate it when folks say, "I'll add security later..." or "Security isn't important now..." or "Ignore the security risk...".

Never store plain text passwords! Please use PHP's built-in functions to handle password security. If you're using a PHP version less than 5.5 you can use the password_hash() compatibility pack. It is not necessary to escape passwords or use any other cleansing mechanism on them before hashing. Doing so changes the password and causes unnecessary additional coding.