Sure, here's a piece:
if ($action == "Login") {
session_register("permissions");
if (!($result = mysql_query("SELECT permissions FROM users WHERE username = '$username' AND password = '" . md5($password) . "'"))) {
mail("webmaster@", "MySQL Query Error", mysql_error());
die("<b>Problem with MySQL query. The error has been logged and will be reviewed. Please contact <a href=\"mailto:webmaster@\">webmaster@***</a> with any questions.</b>\n");
} elseif (($num_rows = mysql_num_rows($result)) != 0) {
while ($row = mysql_fetch_array($result)) {
$permissions = $row["permission"];
}
} else {
session_unregister("permissions");
echo("<font color=\"red\"><b>Invalid Username/Password</b></font>: <a href=\"" . ADMIN . "\">Try Again</a>\n");
html_foot($directory);
exit;
}
}
}
The $permissions variable is not being set to the value of $row["permissions"]. That is the problem.