differentiate user type with php

Question

I have a registration system of my system that has two types of users: teacher and student. has a field on the form that is the "user type" of which you can be a teacher or student. I made a code, but it’s very ugly, and I wanted you to help me. It works, but I was wondering if you could do it in a different and simpler way. if you are a student you have to send to one page and the teacher sends to another. follow the code:

<?php
    ini_set('display_errors', 1);
    ini_set('display_startup_errors', 1);
    error_reporting(E_ALL);

    session_start();
    include_once "conecta.php";

    if(isset($_POST)){
        $email = $_POST['email'];
        $senha = $_POST['senha'];

        if(isset($conexao)){
            $stmt = mysqli_prepare($conexao,"select email from aluno where email = ? and senha = ?");
            mysqli_stmt_bind_param($stmt, "ss", $email, $senha);

            mysqli_stmt_execute($stmt);

            mysqli_stmt_bind_result($stmt, $resultado);
            mysqli_stmt_fetch($stmt);

            if(isset($resultado) > 0){
                $_SESSION['login'] = $email;
                $_SESSION['tipousuario'] = "aluno";
                header("Location: control/home.php");
            }else{
                echo "Usuário ou senha incorretos";
                header("Location: index.php");
            }
        }

        if(isset($conexao)){
            $stmt = mysqli_prepare($conexao, "select email from professor where email = ? and senha = ?");
            mysqli_stmt_bind_param($stmt, "ss", $email, $senha);

            mysqli_execute($stmt);

            mysqli_stmt_bind_result($stmt, $resultado);
            mysqli_stmt_fetch($stmt);

            if(isset($resultado) > 0){
                $_SESSION['login'] = $email;
                $_SESSION['tipousuario'] = "professor";
                header("Location: control/home2.php");
            }else{
                echo "Usuário ou senha incorretos";
                header("Location: index.php");
            }
        }
    }
?>

Answer 1

There’s not much to simplify but I’ve rearranged your code

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

session_start();
include_once "conecta.php";

if(isset($_POST)){
    $email = $_POST['email'];
    $senha = $_POST['senha'];

    if(isset($conexao)){
        $stmt = mysqli_prepare($conexao,"select email from aluno where email = ? and senha = ?");
        mysqli_stmt_bind_param($stmt, "ss", $email, $senha);

        mysqli_stmt_execute($stmt);

        mysqli_stmt_bind_result($stmt, $resultado);
        mysqli_stmt_fetch($stmt);

        if(isset($resultado) > 0){
            $_SESSION['login'] = $email;
            $_SESSION['tipousuario'] = "aluno";
            header("Location: control/home.php");
         }else{
            $stmt = mysqli_prepare($conexao, "select email from professor where email = ? and senha = ?");
            mysqli_stmt_bind_param($stmt, "ss", $email, $senha);

            mysqli_execute($stmt);

            mysqli_stmt_bind_result($stmt, $resultado);
            mysqli_stmt_fetch($stmt);

            if(isset($resultado) > 0){
               $_SESSION['login'] = $email;
               $_SESSION['tipousuario'] = "professor";
               header("Location: control/home2.php");
            }else{
               echo "Usuário ou senha incorretos";
               header("Location: index.php");
            }           

        }
    }
}

Answer 2

I believe that instead of echo "Usuário ou senha incorretos"; you could pass the access error message to the index by parameter, to present to the user. I would also try to extract some methods/isolate things in php functions to make your code more readable and facilitate maintenance, for example by isolating teacher and student verification(untested):

<?php
    ini_set('display_errors', 1);
    ini_set('display_startup_errors', 1);
    error_reporting(E_ALL);

    session_start();
    include_once "conecta.php";

    if(isset($_POST)){
        $email = $_POST['email'];
        $senha = $_POST['senha'];
        $_SESSION['login'] = $email;

        if(isAluno($conexao,$email,$senha)){

            $_SESSION['tipousuario'] = "aluno";
            header("Location: control/home.php");

        }else if(isProfessor($conexao,$email,$senha)){

            $_SESSION['tipousuario'] = "professor";
            header("Location: control/home2.php");

        }else{
            header("Location: index.php?msg=Usuário ou senha incorretos");
        }


    }

        /**
     Função para verificar se é professor
     */
    function isProfessor($conexao,$email, $senha){
        $retorno=false;
        if(isset($conexao)){
            $stmt = mysqli_prepare($conexao,"select email from professor where email = ? and senha = ?");
            mysqli_stmt_bind_param($stmt, "ss", $email, $senha);
            mysqli_stmt_execute($stmt);
            mysqli_stmt_bind_result($stmt, $resultado);
            mysqli_stmt_fetch($stmt);

            if(isset($resultado) > 0){$retorno=true;}
        }
        return $retorno;
    }
    /**
     Função para verificar se é aluno
     */
    function isAluno($conexao,$email, $senha){
        $retorno=false;
        if(isset($conexao)){
            $stmt = mysqli_prepare($conexao,"select email from aluno where email = ? and senha = ?");
            mysqli_stmt_bind_param($stmt, "ss", $email, $senha);
            mysqli_stmt_execute($stmt);
            mysqli_stmt_bind_result($stmt, $resultado);
            mysqli_stmt_fetch($stmt);

            if(isset($resultado) > 0){$retorno=true;}
        }
            return $retorno;
    }
?>

Still, if there are many functions in this file, you might prefer to create a PHP CLASS containing these functions for re-use.

Answer 3

In fact you would solve it on the first If! If the $_SESSION['typousuario'] is different from "student" run the select in the teacher table and direct to the teacher page otherwise direct to the student page!