easy problem, i think..

l_evans

im trying to create a login screen that has 2 conditions. it checks if the user in the database has a 'is_admin' value of 1 or 0. 1 being the administrator and 0 being a normal user. in the 2 if statements it either redirects them to a admin page or a user page. my problem is its not going into the 'if' statements...i think

note the variable password or pw has nothing to do with my code yet, i will implement it later.

pls help here is my code:

<HTML>
<HEAD>
<TITLE>Protocol Login</TITLE>
<meta http-equiv="Content-Type" content="text/html; charset=">
</HEAD>

<?
if($_POST['Submit'] == 'Login')
{
//CONNECTION TO PROTOCOL DATABASE:
mysql_connect("localhost", "root")

or die("Could not connect:" . mysql_error());
mysql_select_db("prot") or die("connection failed");

$username = $POST['username_form'];
$password = $POST['pw_form'];

$access_numq = mysql_query("SELECT is_admin FROM identity WHERE identity.username = '$username'");

$row = mysql_fetch_array($access_numq);

  $access_num = $row['id_admin'];


    // if 'if_admin' is a 1 then load admin page(interface.php)
	if($access_num == 1)
	{
	//FULL ACCESS
    	echo '<p><a href="interface.php">Click here to continue</a></p>';

	}
	 // if 'if_admin' is a 0 then load user page     (interface2.php)
	if($access_num == 0)
	{
		//LIMITED ACCESS
		echo '<p><a href="interface2.php">Click here to continue</a></p>';
	}

else
echo 'not in db';

//CLOSE DATABASE
mysql_close();
}
?>

<form method="post" action="login.php">
<p>
<input type="text" name="username_form">
<font face="Arial, Helvetica, sans-serif"><b>Enter your username</b></font></p>
<p>
<input type="text" name="pw_form">
<font face="Arial, Helvetica, sans-serif"><b>Enter your password</b></font><b><font face="Verdana, Arial, Helvetica, sans-serif">
</font></b></p>
<p> </p>
<p>
<input type="submit" name="Submit" value="Login">
</p>
</form>

</BODY>
</HTML>

Natty_Dreadlock

U got a typo: $access_num = $row['id_admin']; should be $access_num = $row['is_admin']; !!
But besides, your way to code the security restrictions is quite a weak one... Becuase u directly link to the interface pages, anyone can access em who just knows their url. I just told u to avoid further problems, if u realized that and your code is just for testing purposes, forget about my hints and just correct your typo.
Hasta siempre

l_evans

thanks man... my bad. yeh this is just 4 testing, i will make sure the security is a bit better than that,

l8ta

Gemini1706

Originally posted by Natty_Dreadlock
... Becuase u directly link to the interface pages, anyone can access em who just knows their url...

So you suggest to have the admin page put in a different folder? If that folder is not in your www then how admins can view it? and if it is inside your www folder then same thing as before: anybody can access it...

I am a little bit confused about securing pages/permissions in general in webservers...

Please further describe how can one secure a page to only be viewed by permitted people without putting it in your global access folders...

Thanks in advance from a newbie 🙂

Natty_Dreadlock

There are different way to accomplish that:
First one: Use the .htaccess-Files to implement a server-based security check. I cannot describe that in details, but there are lots of tutorials on the net which show how to do that. Search on Google or chekc the official apache documentation as a starting point.
Second: Use php-sessions (again, chekc tuts / docu) and set a session variable (e.g. $_SESSION["user"]) to some reasonable value. Now, on your protected page, you can read the value of that variable and decide which content u wanna display (e.g. admin-only function).
Of course I cannot give u a complete overview because it's quite a compley topic, so start searching the web and reading tutorials. If u encounter any more precise questions, feel free to mail me or post here.
Hope that helped a bit
Hasta siempre