Okay...
Im using sessions to control access to pages in my administration area...
Heres how im trying to do it...
I have a variable called
$access_level
I define it a number based on the level of acess that gets compared to the users level in the database.
On each page I have an include that I start like this
$access_level = 5;
include = 'accessctrl.php';
The session gets registered and the values get stored when the user sucessfully logs in.
here is the code inside the include...
<html>
<head>
<title>WerkkreW Administration Area</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="content.css" rel="stylesheet" type="text/css">
</head>
<body bgcolor="#333333">
<?
session_start();
$user_level = $_SESSION['user_level'];
if ($access_level != $user_level AND $user_level != 5 AND $access_level != 9 OR !isset($user_level)){
echo "<strong><center><font color=\"red\">You do not have permission to view this page!</font></strong></center>";
exit();
}
?>
</font>
</center>
</body>
</html>
I call this at the top of every page I want to protect in any way.
The session is registered like this when the user logs in:
<?php
//Check user login script
//MySQL Connection Informaion
include 'db.php';
/*Convert to simple variables
$username = $_POST['username'];
$password = $_POST['password'];
*/
if((!$username) || (!$password)){
echo "Please enter ALL of the information! <br />";
include 'login_form.html';
exit();
}
//convert password to md5 encryption
$password = md5($password);
//Check user info in database
$sql = mysql_query("SELECT * FROM members WHERE username='$username' AND
password='$password' AND activated='1'");
$login_check = mysql_num_rows($sql);
if($login_check > 0){
while($row = mysql_fetch_array($sql)){
foreach($row AS $key=>$val){
$key = stripslashes($val);
}
//Register session variables
session_register('first_name');
$_SESSION['first_name'] = $row['first_name'];
session_register('last_name');
$_SESSION['last_name'] = $row['last_name'];
session_register('email_address');
$_SESSION['email_address'] = $row['email_address'];
session_register('special_user');
$_SESSION['user_level'] = $row['user_level'];
session_register('tag');
$_SESSION['tag'] = $row['tag'];
session_register('username');
$_SESSION['username'] = $row['username'];
session_register('info');
$_SESSION['info'] = $row['info'];
mysql_query("UPDATE members SET last_login=now() WHERE username='$username'");
header("Location: login_success.php");
}
} else {
echo "You could not be logged in! Either the username and password do not
match or you have not activated your membership!<br />
Please try again!<br />";
include 'login_form.html';
}
?>
Every page in my admin area is protected, and if I want all LOGGED IN users to be able to access it, I define $access_level = 9
Now, in certain page calls I continuously get the error:
Warning: Cannot send session cache limiter - headers already sent (output started at /home/msatur/public_html/php/accessctrl.php:9) in /home/msatur/public_html/php/accessctrl.php on line 11
I have checked and double checked for the instance of session_start(); occuring twice in one script and i have gotten rid of it but the error still pops up, in the same scripts all the time, but I cant figure out why.
I also get that error if I try to access a page I dont have access to when im NOT logged in, and understand why this is...I think its because its trying to start a session that hasnt been defined, but when I am logged in (not long enough for the session to expire mind you) I still get the error...Im thinking I can prevent at least this part of it by adding a statement that wont try to start the session if the session doesnt exist, but I dont know how to do this.
Any ideas?
By the way, sorry for the long ass post, but I figured youd need all the info in order to help
