Login Script with Different Levels?

impactdesignpro

I am designing a site that has an admin section and I need a login script that has different privileges.
For example -Main Admin has the right to add or delete other admin's. Other admin's can login and do what they need to do within the admin section (but have no control over setting up or deleting other admin's).

Can someone point me in the right direction. Thanks

Joseph07

One of the way to do it is to have a database column which include the privilege of the user.

For eg. Normal Admin have a privilege of 1 while Main Admin have a privilege of 3. When the user login, capture the privilege of the user. When you want to show the access of the function to the user. Do something like this.

if ($rank == 1) {
 // Do not show the function
} elseif ($rank == 3) {
 // Show the function
}

Hope this give you some light.

impactdesignpro

That's what I would like to do... Have a field which will contains a value (1=main admin, 2=user) - based upon the value given will allow or restrict access to certain parts. but getting it to work is where I am brain fried... I would appreciate your help if you don't mind

dagon

and so far you have what?

impactdesignpro

Ok here is what I have...
I created a table on my db with 4 fields
'id' , 'username', 'password','level_access

I have a login page (login.php):

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Admin Login</title>
<link href="admin.css" rel="stylesheet" type="text/css" />
</head>

<body>
<div align="center"></div>
<table width="300" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC" class="box">
<tr>
<form name="form" method="post" action="checklogin.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td colspan="2"><div align="center"><span class="style6">Admin Login </span></div></td>
</tr>
<tr>
<td width="78"><div align="right" class="style2">Username:</div></td>
<td width="294"><input name="myusername" type="text" class="style2" id="myusername"></td>
</tr>
<tr>
<td class="style2"><div align="right" class="style9"><span class="style2">Password</span>:</div></td>
<td><input name="mypassword" type="password" class="style2" id="mypassword"></td>
</tr>
<tr>
<td></td>
<td><input type="submit" name="Submit" value="Login"></td>
</tr>
</table>
</td>
</form>
</tr>
</table>
<?php 
include("footer.php");
?>
</body>
</html>

I have a check login page (checklogin.php)

<?php
include("includes/config.inc.php");

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from signup form 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

$sql="SELECT * FROM $tbl_name2 WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword"); 
header("location:index.php");
}
else {
echo "Wrong Username or Password";
}
?>

I have a logout page (logout.php):

<? 
session_start();
session_destroy();
header( 'Location: index.php' )
?>

On the top of the php pages I wish to protect I have this code:

<? 
session_start();
if(!session_is_registered(myusername)){
header("location:login.php");
}
?>

What I would like to do is add the 'level_access" to the script. This is not a typical mebership login section- I am trying to create an "Admin section" so I really do not need a registration page, the main admin will activate or deactivate other admins but I need to assign a main admin from regular admins (if that makes anysense?)

Also I have a page that allows the admins to delete a row from a table. Once they click on the hyperlink which contains the id of the row it go to another page called delete.php - the code looks like this:

<?php
session_start();
if(!session_is_registered(myusername)){
header("location:login.php");
}
header('refresh:3;url=list.php'); 
include("includes/config.inc.php");

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// get value of id that is sent from address bar
$id = intval($_GET['id']);

// Delete data in mysql from row that has this id 
$sql="DELETE FROM $tbl_name WHERE id='$id'";
$result = mysql_query($sql) or die("SQL Error: ".mysql_error());

// if successfully deleted
if($result){
echo "Deleted Successfully";
echo "<BR>";
echo "<a href='list.php'>Back to main page</a>";
}

else {
echo "ERROR";
}

// close connection 
mysql_close();
?>

The problem is - even though it has the login script at the top - it doesn't prevent the script from executing- I see this as a big security problem. Someone call enter in the address bar www.somewhere.com/delete.php?=id1 and so on and delete records without login on.

Thanks for your help

Joseph07

How long have this script been? Are you still updating yourself with PHP?

It looks to me that this seem to be a old script with session_register and stuff like that. You should change it to $_SESSION.

To add in the user level access, you can add in something like this after checking user login.


// Add in the following
$_SESSION['access'] = $fetch['level_access'];

Lastly, use isset, !empty to check for your values.

impactdesignpro

I'm ashamed to admit it, but I am a novice - even more ashamed to know that I'm learning an outdated form of php. Thanks for the help I greatly appreciate it.

Joseph07

It is alright that you learn from an outdated PHP script. But you have to know which are the deprecated ones and which are not.

Everyone learns from mistake and stuff, so don't be dishearten.