Add access level to this php code

Question

<?PHP
include('config.php');
# Validar os dados do usuário

function anti_sql_injection($string)
    {
        include('config.php');
        $string = stripslashes($string);
        $string = strip_tags($string);
        $string = mysqli_real_escape_string($conexao,$string);
        return $string;
    }

$sql = mysqli_query($conexao,"select * from sec_iden where login_sec='".anti_sql_injection($_POST['login_sec'])."' and senha_sec='".anti_sql_injection($_POST['senha_sec'])."' limit 1") or die("Erro");
$linhas = mysqli_num_rows($sql);
if($linhas == '')
    {
        ?>
        <div class="msg2 padding20">Usuário não encontrado ou usuário e senha inválidos.</div>
        <?PHP
    }
else
    {
        while($dados=mysqli_fetch_assoc($sql))
            {
                session_start();
                $_SESSION['login_sec_sessao'] = $dados['login_sec'];
                header("Location: conteudo.php");
            }
    }
?>

well I wanted that when the field I created in db called ( Adm was = 1 ) it would redirect to administrative.php and when it was = 0 for content.php but I’m not able to do that, an if would solve that and where I would put that if ?

Answer 1

Yes, in that case a if would suffice.

Would look like this:

<?PHP
include('config.php');
# Validar os dados do usuário

function anti_sql_injection($string)
    {
        include('config.php');
        $string = stripslashes($string);
        $string = strip_tags($string);
        $string = mysqli_real_escape_string($conexao,$string);
        return $string;
    }

$sql = mysqli_query($conexao,"select * from sec_iden where login_sec='".anti_sql_injection($_POST['login_sec'])."' and senha_sec='".anti_sql_injection($_POST['senha_sec'])."' limit 1") or die("Erro");
$linhas = mysqli_num_rows($sql);
if($linhas == '')
    {
        ?>
        <div class="msg2 padding20">Usuário não encontrado ou usuário e senha inválidos.</div>
        <?PHP
    }
else
    {
        while($dados=mysqli_fetch_assoc($sql))
            {
                session_start();
                $_SESSION['login_sec_sessao'] = $dados['login_sec'];
                if($dados['adm'] == '1') header("Location: administrativo.php"); 
                else header("Location: conteudo.php");
            }
    }
?>

Note that this example is valid only in case of two login situations as you passed, ie if it is administrator or not.

OBS: That way you’re not doing access control, you’re just redirecting the user to a particular page.