[RESOLVED] if ($_session["admin']== 0)

r2ks

Please help i have a Login page and i would like person to be directed to one of 2 areas based on admin or Non admin sign in. Here is what i Have

<?php
if ($SESSION["admin"] == 0)
{

Header("Location: sponser.php");
}
else
if ($SESSION["admin"] == 1)
{
//redirect to Guest area
Header("Location: admin.php");
exit();

?>

what happens it goes to the sponsor.php no matter what i can even be on the sponsor page click on Logout and it takes me back to the Sponsor.php page ( it suppose to go to the login page ) if i type in the url it takes me to the Sponsor.php page even if i type index.php HELP

bradgrafelman

Looks like you forgot to call [man]session_start/man.

r2ks

Thank you for your Help

<?php 
session_start()
if ($_SESSION["admin"] == 0)
{
Header("Location: sponser.php");
}
else
if ($_SESSION["admin"] == 1)
{
//redirect to Guest area
Header("Location: admin.php");
exit();


ini_set ("display_errors", "1");
error_reporting(E_ALL);
?>

Parse error: syntax error, unexpected T_IF in /home/realityt/public_html/eventtracker/index.php on line 3
This is what i get ???

bradgrafelman

Missing semicolon on the second line.

r2ks

I Tried that it did not work... I still get the same error
Thanks ...

<?php 
session_start()
if ($_SESSION["admin"] == 0);
{
Header("Location: sponser.php");
}
else
if ($_SESSION["admin"] == 1)
{
//redirect to Guest area
Header("Location: admin.php");
exit();


ini_set ("display_errors", "1");
error_reporting(E_ALL);
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Pledge Site</title>
<link rel="stylesheet" type="text/css" href="fw-2-1-col/main.css" />
<style type="text/css">
<!--
.style1 {font-size: 24px}
.style2 {
	font: bold 18px;
	color: #000000;
	font-size: medium;
}
.style3 {
	font-size: 36px;
	font-family: Galliard, Lorrenne;
}
-->
</style>
</head>

<body>

   <!-- Begin Wrapper -->
<div id="wrapper">

     <!-- Begin Header -->
<div class="style1" id="header">

	       Welcome to Event Tracker  Web Site </div>
<!-- End Header -->

	 <!-- Begin Content -->
	 <div id="content">
	   <div id="Content1">
	     <p class="style2">Hello and Welcome to the Event Tracker web site this site is used for tracking Participants and Sponsors of Events that your Organization my put on. Please Login below if you do not have a Login ID Please call the Event organizer and get your login info.</p>
	     <p>&nbsp;</p>
	     <p>&nbsp;</p>
	   </div>
	   <div id="content2">
	     <div id="lock"><img src="images/lock.jpg" alt="" width="78" height="74" id="lock2" /><span class="style3">Login </span></div>
<p align="left">&nbsp;</p>
<?php
include ('conn.php');
//$pass5= md5($password);
//TEST TO SEE IF THE ENCRYPTED PASSWORD MATCHES IN THE DB, WHICH IT DON'T!
//echo $password2;
if(isset($_GET['op']) and $_GET['op'] == 'login')
{
 if (!$_POST["username"] || !$_POST["password"])
  {
  die("You need to provide a username and password. Please Hit the Back Button");
  }
 // Create query
  $q = "SELECT * FROM `users` "
  ."WHERE `username`='".$_POST["username"]."' "
   ."AND `password`='".md5 ($_POST["password"])."' "
    ."LIMIT 1 ";
 // Run query
 $r = mysql_query($q);
 if ( $obj = mysql_fetch_object($r) )
  {
  // Login good, create session variables
 $_SESSION["valid_id"] = $obj->id;
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();
  $_SESSION["admin"] = $obj->admin; 
  // Redirect to member page

}
  }
 else
  {
  // Login not successful
  die("Sorry, could not log you in. Wrong login information.<a href=\"index.php\">PLEASE Sign Back in</a>");
	   }
}
else
 {
//If all went right the Web form appears and users can log in
 echo "<form action=\"?op=login\" method=\"POST\">";
 echo "Username: <input name=\"username\" size=\"15\"><br />";
 echo "Password: <input type=\"password\" name=\"password\" size=\"15\"><br />";
 echo "<input type=\"submit\" value=\"Login\">";
 echo "</form>";

 }

?>
<p align="left">&nbsp;</p>
		     <p align="left"><br />
		     </p>
		   </div>
		 </div>
<!-- End Content -->

	 <!-- Begin Footer -->
	 <div class="style2" id="footer"></div>
 <!-- End Footer -->

</div>
<!-- End Wrapper -->
 </body>
 </html>

Here is all my Code On the Whole form
Thank you so much

dagon

still Missing semicolon on the second line.

bradgrafelman

The second line being:

session_start()

If you didn't know that all PHP statements must be terminated in a semicolon, you might want to view some basic Intro to PHP -type guides to get accustomed to the programming language.

Unlike Javascript, PHP is like C++ in that it's very (read: completely) unforgiving when you fail to terminate a statement with a semicolon.

(And before anyone puffs up their chest and claims that's wrong, yes, I know you can omit the semicolon on the last statement of a PHP script and instead close it with a '?>', but let's not get into technicalities. :p)

Weedpacket

Oh, I was going to rant off on how the semicolon in JavaScript isn't a statement terminator ... :p

r2ks

<?php 
session_start();
if ($_SESSION["admin"] == 0)
{
Header("Location: sponser.php");
}
else
if ($_SESSION["admin"] == 1)
{
//redirect to Guest area
Header("Location: admin.php");
exit();


ini_set ("display_errors", "1");
error_reporting(E_ALL);
?>

Thank you i tried semi colon on the second line and still all it does is Shoot me right to the sponser.php page if i comment out these lines the Login page comesup ????

dagon

r2ks;10918110 wrote:

Thank you i tried semi colon on the second line and still all it does is Shoot me right to the sponser.php page if i comment out these lines the Login page comesup ????[/QUOTE]

well then $_SESSION["admin"] must be equal to 0. Where and how to you set $_SESSION["admin"]

r2ks

<?php
$q = "SELECT * FROM `users` "
  ."WHERE `username`='".$_POST["username"]."' "
   ."AND `password`='".md5 ($_POST["password"])."' "
       ."LIMIT 1 ";
 // Run query
 $result = mysql_query($q);
if ( $row = mysql_fetch_row($result) )
  {
  // Login good, create session variables
 $_SESSION["valid_id"] = $row->id;
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();
  $_SESSION["admin"] = $row->admin; 
  // Redirect to member page
?>

I am getting the session admin from the Data Base Users and the Field Admin
I am new to this so am i doing it Right ????

bradgrafelman

Do you ever call [man]session_start/man in that script?

Also, note that your script is vulnerable to SQL injection attacks. User-supplied data should never be placed directly into a query. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man.

r2ks

<?php
session_start();
//print_r ($_SESSION);die();
include ('conn.php');

if(isset($_GET['op']) and $_GET['op'] == 'login')
{
 if (!$_POST["username"] || !$_POST["password"])
  {
  die("You need to provide a username and password. Please Hit the Back Button");
  }
 // Create query
  $q = "SELECT * FROM `users` "
  ."WHERE `username`='".$_POST["username"]."' "
   ."AND `password`='".md5 ($_POST["password"])."' "
       ."LIMIT 1 ";
 // Run query
 $result = mysql_query($q);
if ( $row = mysql_fetch_row($result) )
  {
  // Login good, create session variables
 $_SESSION["valid_id"] = $row['id'];
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();
  $_SESSION["admin"] = $row['admin']; 
  // Redirect to member page
if ($_SESSION["admin"] == 0) {   

header("Location: sponser.php");
exit;
}
 else 
 {
// Redirect to Guest area
header("Location: admin.php");
exit();
}
  }
 else
  {
  // Login not successful
  die("Sorry, could not log you in. Wrong login information.<a href=\"index.php\">PLEASE Sign Back in</a>");
	   }
   }
else
 {
//If all went right the Web form appears and users can log in
 echo "<form action=\"?op=login\" method=\"POST\">";
 echo "Username: <input name=\"username\" size=\"15\"><br />";
 echo "Password: <input type=\"password\" name=\"password\" size=\"15\"><br />";
 echo "<input type=\"submit\" value=\"Login\">";
 echo "</form>";
 }

?>

Here is the script I do call Session_start() at the beginning

bradgrafelman

You might try doing a [man]session_write_close/man right before you call header(); it might be the case where PHP didn't have enough time to finish writing the new session data to disk.

You can also do a [man]print_r/man on the $_SESSION array on the sponser.php page to see what the session data looks like.

r2ks

i did what you said

if ($_SESSION["admin"] == 0) {

session_write_close();
header("Location: sponser.php");
exit;
}
else
{
// Redirect to admin area
header("Location: admin.php");
exit();
}

Nothing
i DID the print_r session on the Sponsers screen and Get
Array ( [valid_id] => [valid_user] => 2222 [valid_time] => 1244854623 [admin] => )

So as i am looking at this i see NO Valid id or No admin Looking at my code where is the Problem i can not see it.

<?php
 $q = "SELECT * FROM `users` "
  ."WHERE `username`='".$_POST["username"]."' "
   ."AND `password`='".md5 ($_POST["password"])."' "
       ."LIMIT 1 ";
 // Run query
 $result = mysql_query($q);
if ( $row = mysql_fetch_row($result) )
  {
  // Login good, create session variables
 [COLOR="Red"]$_SESSION["valid_id"] = $row['id'];[/COLOR]
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();
  [COLOR="Red"]$_SESSION["admin"] = $row['admin']; [/COLOR]
  // Redirect to member page


?>

it is somewhere here but where ??

bradgrafelman

Do the same print_r() on the first page before the redirect to sponser and see what values are being populated; do a print_r() on $row to see what MySQL returned.

r2ks

Thank you i did that and Low and behold i get the session number
Array ( [0] => 21 [1] => mary [2] => b8e7be5dfa2ce0714d21dcfc7d72382c [3] => [4] => [5] => [6] => [7] => [8] => [9] => [10] => [11] => 0 [12] => 2009-06-05 22:09:47 ) ( Guest Sign ON )

Row 11 is where i Grab the Number depending on the User signing in 0 for Guest 1 for admin

Array ( [0] => 15 [1] => 2222 [2] => 934b535800b1cba8f96a5d72f72f1611 [3] => 2222 [4] => [5] => [6] => [7] => [8] => [9] => [10] => 2222 [11] => 1 [12] => 2009-06-04 19:01:17 ) ( Admin Sign ON )

So it is Getting the Value ?????

bradgrafelman

Which array are you printing there? From what I can see, that array uses numeric indexes while all of the arrays you deal with in your code are using associative indexes.

r2ks

WOWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
Thank you Thank you WE HAVE figured this OUT
when you said

Which array are you printing there? From what I can see, that array uses numeric indexes while all of the arrays you deal with in your code are using associative indexes.

I Looked back at everything ( Got Coffee new Breath of Air and Looked ) There it was right in front of Me. Looking at my data base i am looking at the Fields and going down trough first field in my data base user_id
This whole time i am Calling $_SESSION["valid_id"] = $row['id']; Just Id I change this to user_id and there we Go works Great Again THANK YOU from the Bottom of my Heart.