PHP login with permission levels

Question

I have a problem with my code to separate logins. I want when a login with Rank = 1 it redirects to a page, and when the Rank is = 0 go to another. I tried to do it but I didn’t get it because he always sends it to the same one. How to solve it?

<?php
require_once 'config.php';

$userName = $_POST["user-name"];
$userPass = $_POST["user-pass"];
$criptSen = hash("whirlpool", $userPass);
@$rediURL = $_GET["url"];

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE Usuario='$userName'         AND Senha='$criptSen'");
        $query = mysql_query($SQL);
        while($row = mysql_fetch_array($query)){
            $rank = $row["Rank"];
        }
if(mysql_num_rows($SQL) != 0){

session_start();

$_SESSION['Usuario'] = $userName;
$_SESSION['Senha']   = $criptSen;

if($rank = 0){
  header("Location: membro.php");   
} elseif($rank = 1) {
     header("Location: admin/index.php");   
}   
} else {
header("Location: index.php");
}
?>

Code to protect Internal Pages Rank = 1

@$Usuario = $_SESSION["Usuario"];
@$Rank   = $_SESSION['Rank']

if(!(isset($Usuario) && isset($Senha))){

$url = explode("/", $_SERVER["REQUEST_URI"]);

header("Location: index1.php?url=$url[3]");

} else if(isset($Usuario) && isset($Senha)){

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE     Usuario='$Usuario' AND Senha='$Senha' AND Rank=1");

if(mysql_num_rows($SQL) == 0){

    echo "<script>alert(\"Area Restrita\");</scrpit>";
    header("Location: ../index.php");
} 
}
?>

Answer 1

Normalization of Question PHP Code

_Obs: mysql__* is obsolete in the new versions of PHP, so this code could be placed in Mysqli or PDO, but, I did following the question

Errors Found:

$userName = $_POST["user-name"];
$userPass = $_POST["user-pass"];
@$rediURL = $_GET["url"];

Did not use isset to test the $_POST and $_GET, and the best practice would be to filter_input.

---

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE Usuario='$userName'         AND Senha='$criptSen'");    
$query = mysql_query($SQL);

Notice that he made mysql_query 2 times !!!

---

$rank = $row["Rank"];

Realize that he wanted to take the rank without calling in SQL

---

if($rank = 0){
  header("Location: membro.php");
} elseif($rank = 1) {
     header("Location: admin/index.php");
}

Made comparison $rank with only 1 equal, comparison are 2 equal or 3 if you want besides testing the value your type

---

$_SESSION['Usuario'] = $userName;
$_SESSION['Senha']   = $criptSen;

You saved the password in Session, for which reason, that wouldn’t be a security breach?

---

Code Normalized

<?php
    require_once    'config.php';

    $userName = isset($_POST["user-name"]) ? $_POST["user-name"]: '0';
    $userPass = isset($_POST["user-pass"]) ? $_POST["user-pass"]: '0';

    if ($userName != '0' && $userPass != '0'){

        $criptSen = hash("whirlpool", $userPass);
        $rediURL  = isset($_GET["url"]) ? $_GET["url"]: ''; 

        $SQL = "SELECT Usuario, Senha, Rank FROM utilizadores WHERE Usuario='$userName' AND Senha='$criptSen' limit 1";
        $query = mysql_query($SQL);

        if (mysql_num_rows($query)>0)
        {
            $row = mysql_fetch_array($query);
            $_SESSION['Usuario'] = $row['Usuario'];     
            $_SESSION['Rank']    = $row['Rank'];
            mysql_free_result($query);

            if($row['Rank'] == 0){
                header("Location: membro.php");
            } else {
                if($row['Rank'] == 1) {
                    header("Location: admin/index.php");                
                }
            }       

        } else {
            if (isset($query)){
                mysql_free_result($query);
            }
            header('location: index.php');      
        }   

    } else {
        header('location: index.php');
    }
?>

Why I Saved the Rank in a Session?

To be tested on page uploads and check if such user is allowed to view the page.

Normalization Next Page

<?php
    session_start();
    $Usuario = isset($_SESSION["Usuario"]) ? $_SESSION["Usuario"]: '';
    $Rank    = isset($_SESSION['Rank'])    ? $_SESSION['Rank']   : '';

    if ($Usuario != '' && $Rank == 1){  
        //AUTORIZADO
        //AQUI ELE TA COM O Rank = 1 e logado com Usuario
    } 
    else 
    {
        //NÃO AUTORIZADO
        echo "<script>alert(\"Area Restrita\");</scrpit>";
        header("Location: ../index.php");   
    }

Note: Now you do not need to access the base again, because, the $Rank is in the $_SESSION which you can recover by using this template for the various pages of your system. Another observation is not to use script (javascript) in the middle of PHP, maybe redirecting to a page is much better, with messages that the same is not authorized

Answer 2

Your SELECT returns the fields Usuario, Senha, however you try to catch $row["Rank"]. Change the SELECT to:

$SQL = mysql_query("SELECT Usuario, Senha, Rank FROM utilizadores WHERE Usuario='$userName' AND Senha='$criptSen'");

Make this change to the comparison (==) instead of just =

if($rank == 0){

  header("Location: membro.php");

} elseif($rank == 1) {

     header("Location: admin/index.php");

}

Answer 3

The mistake is in the = the correct is ==.

if($rank == 0)
{
  header("Location: membro.php");
} 
elseif($rank == 1) 
{
  header("Location: admin/index.php");
}

Behold Comparison operators in the php.net.

Answer 4

I won’t suggest OO because it seems that it is already forwarded, so following the current structure, at least creates a function to do this check on the protected pages and calls this function, instead of repeating the code on all pages.

Another thing, the colleague’s idea of using Sesssion is good, but if you go this way keep a value like $_SESSION['login'] = true; instead of storing the password in the section, so you won’t need to keep checking the bank all the time to see if the password checks out.