PHP login with permission levels

Asked

Viewed 3,355 times

12

I have a problem with my code to separate logins. I want when a login with Rank = 1 it redirects to a page, and when the Rank is = 0 go to another. I tried to do it but I didn’t get it because he always sends it to the same one. How to solve it?

<?php
require_once 'config.php';

$userName = $_POST["user-name"];
$userPass = $_POST["user-pass"];
$criptSen = hash("whirlpool", $userPass);
@$rediURL = $_GET["url"];

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE Usuario='$userName'         AND Senha='$criptSen'");
        $query = mysql_query($SQL);
        while($row = mysql_fetch_array($query)){
            $rank = $row["Rank"];
        }
if(mysql_num_rows($SQL) != 0){

session_start();

$_SESSION['Usuario'] = $userName;
$_SESSION['Senha']   = $criptSen;

if($rank = 0){
  header("Location: membro.php");   
} elseif($rank = 1) {
     header("Location: admin/index.php");   
}   
} else {
header("Location: index.php");
}
?>

Code to protect Internal Pages Rank = 1 

@$Usuario = $_SESSION["Usuario"];
@$Rank   = $_SESSION['Rank']

if(!(isset($Usuario) && isset($Senha))){

$url = explode("/", $_SERVER["REQUEST_URI"]);

header("Location: index1.php?url=$url[3]");

} else if(isset($Usuario) && isset($Senha)){

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE     Usuario='$Usuario' AND Senha='$Senha' AND Rank=1");

if(mysql_num_rows($SQL) == 0){

    echo "<script>alert(\"Area Restrita\");</scrpit>";
    header("Location: ../index.php");
} 
}
?>

php sql session select

4 answers

16


Normalization of Question PHP Code

_Obs: mysql__* is obsolete in the new versions of PHP, so this code could be placed in Mysqli or PDO, but, I did following the question

Errors Found:

$userName = $_POST["user-name"];
$userPass = $_POST["user-pass"];
@$rediURL = $_GET["url"];

Did not use isset to test the $_POST and $_GET, and the best practice would be to filter_input. 

$SQL = mysql_query("SELECT Usuario, Senha FROM utilizadores WHERE Usuario='$userName'         AND Senha='$criptSen'");    
$query = mysql_query($SQL);

Notice that he made mysql_query 2 times !!!

$rank = $row["Rank"];

Realize that he wanted to take the rank without calling in SQL

if($rank = 0){
  header("Location: membro.php");
} elseif($rank = 1) {
     header("Location: admin/index.php");
}

Made comparison $rank with only 1 equal, comparison are 2 equal or 3 if you want besides testing the value your type

$_SESSION['Usuario'] = $userName;
$_SESSION['Senha']   = $criptSen;

You saved the password in Session, for which reason, that wouldn’t be a security breach?

Code Normalized

<?php
    require_once    'config.php';

    $userName = isset($_POST["user-name"]) ? $_POST["user-name"]: '0';
    $userPass = isset($_POST["user-pass"]) ? $_POST["user-pass"]: '0';

    if ($userName != '0' && $userPass != '0'){

        $criptSen = hash("whirlpool", $userPass);
        $rediURL  = isset($_GET["url"]) ? $_GET["url"]: ''; 

        $SQL = "SELECT Usuario, Senha, Rank FROM utilizadores WHERE Usuario='$userName' AND Senha='$criptSen' limit 1";
        $query = mysql_query($SQL);

        if (mysql_num_rows($query)>0)
        {
            $row = mysql_fetch_array($query);
            $_SESSION['Usuario'] = $row['Usuario'];     
            $_SESSION['Rank']    = $row['Rank'];
            mysql_free_result($query);

            if($row['Rank'] == 0){
                header("Location: membro.php");
            } else {
                if($row['Rank'] == 1) {
                    header("Location: admin/index.php");                
                }
            }       

        } else {
            if (isset($query)){
                mysql_free_result($query);
            }
            header('location: index.php');      
        }   

    } else {
        header('location: index.php');
    }
?>

Why I Saved the Rank in a Session?

To be tested on page uploads and check if such user is allowed to view the page.

Normalization Next Page

<?php
    session_start();
    $Usuario = isset($_SESSION["Usuario"]) ? $_SESSION["Usuario"]: '';
    $Rank    = isset($_SESSION['Rank'])    ? $_SESSION['Rank']   : '';

    if ($Usuario != '' && $Rank == 1){  
        //AUTORIZADO
        //AQUI ELE TA COM O Rank = 1 e logado com Usuario
    } 
    else 
    {
        //NÃO AUTORIZADO
        echo "<script>alert(\"Area Restrita\");</scrpit>";
        header("Location: ../index.php");   
    }

Note: Now you do not need to access the base again, because, the $Rank is in the $_SESSION which you can recover by using this template for the various pages of your system. Another observation is not to use script (javascript) in the middle of PHP, maybe redirecting to a page is much better, with messages that the same is not authorized

  • Thank you very much, Fccdias. Only now the code I had to protect all the backoffice pages must be wrong, I will post it on the main topic so that it helps me if possible to put it right, just like the one that provided me.

  • @Luismiguelgt, for nothing...

  • Thank you very much Fccdias, everything worked impeccably well!

  • I had never seen something like this post, very well structured and with clear and objective explanations, congratulations @user6026.

  • Hey! That question fell from the sky, it was exactly my question. I tried to use your code changing some details to adapt to what I had ready and good, redirects to the same page. I wonder if you can help me?

5

Your SELECT returns the fields Usuario, Senha, however you try to catch $row["Rank"]. Change the SELECT to: 

$SQL = mysql_query("SELECT Usuario, Senha, Rank FROM utilizadores WHERE Usuario='$userName' AND Senha='$criptSen'");

Make this change to the comparison (==) instead of just =

if($rank == 0){

  header("Location: membro.php");

} elseif($rank == 1) {

     header("Location: admin/index.php");

}

  • I had already changed it Lucas, it didn’t work anyway. :S

  • @Luismiguelgt I made a change in the answer. See if it works.

  • @Luismiguelgt Whenever you want to say something about a reply, use the comments instead of creating a new answer

3

The mistake is in the = the correct is ==.

if($rank == 0)
{
  header("Location: membro.php");
} 
elseif($rank == 1) 
{
  header("Location: admin/index.php");
}

Behold Comparison operators in the php.net.

2

I won’t suggest OO because it seems that it is already forwarded, so following the current structure, at least creates a function to do this check on the protected pages and calls this function, instead of repeating the code on all pages.

Another thing, the colleague’s idea of using Sesssion is good, but if you go this way keep a value like $_SESSION['login'] = true; instead of storing the password in the section, so you won’t need to keep checking the bank all the time to see if the password checks out.

Browser other questions tagged php sql session select

You are not signed in. Login or sign up in order to post.