PHP login authentication problem (beginner)

Question

scenario is I have different access levels on this site, I have the simple login process working for all valid users however I am now trying to seperate the different users fo different access to pages.

here is my code at the start of my page:

// CHECKS IF THE USER HAS LOGGED IN
session_start();

if(!isset($_SESSION['logged_in']) || !$_SESSION['logged_in']){
   header("location:index.php");
}

if(!$_SESSION['mystatus']=='1'){
   header("location:access_error.php");
}

so basically I want this page to only be accessible by users with the access level of 1 if they are logged in however do not have the correct access level direct them accordingly.

at the moment it allows users who have logged in with different access levels (e.g 3) to still view this page.

help please.

many thanks,

Note that you might want to use lower than and greater than operators or bit-wise comparison. That allows for more fine-grained access control. — Lekensteyn
– Lekensteyn, Commented Mar 22, 2011 at 14:37
but by using say greater than surely is only decent if I want all users with a higher access level to have access the page? My case being users with access level 2, should not have access to this page. — dapperwaterbuffalo
– dapperwaterbuffalo, Commented Mar 22, 2011 at 14:47
In that case, you may want to look at bitwise operators. In short, each bit is a permission, and can be set to 0 (no access) or 1 (access). Next reading: Wikipedia article. A question about bitwise operations in PHP. — Lekensteyn
– Lekensteyn, Commented Mar 22, 2011 at 14:54

Lekensteyn · Accepted Answer · 2011-03-22 14:34:48Z

3

!$_SESSION['mystatus'] == 1 will be interpreted as (!$_SESSION['mystatus']) == 1. As $_SESSION['mystatus'] contains values non-false values like 1 and 3, it evaluates to true !true turns into false and therefore false == 1 does not match.

Use the NOT EQUAL operator (!=):

$_SESSION['mystatus'] != 1

answered Mar 22, 2011 at 14:34

Lekensteyn

67k25 gold badges169 silver badges205 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Lekensteyn Over a year ago

@buymypies: if this answers your question, mark it as accepted by clicking the v on the left of this answer.

Marc B · Accepted Answer · 2011-03-22 14:36:06Z

2

if(!$_SESSION['mystatus']=='1'){

constructs like this are very dangerous, especially if you're new to PHP and haven't figured out its operator precedence rules.

This gets interpreted as "take the logic NOT of whatever's in the mystatus session variable, and compare to a string '1'."

What you want is

if ($_SESSION['mystatus'] !== '1') {

"If the mystatus variable is a string and not equal to a string of '1', then evaluate to true.

answered Mar 22, 2011 at 14:36

Marc B

362k44 gold badges433 silver badges508 bronze badges

3 Comments

Jakub Over a year ago

+1, people always confuse =, == and === and its purpose.

Your Common Sense Over a year ago

i see no eason in using string '1' instead of number 1

Marc B Over a year ago

@Col: Me either, but that's how the OP has it.

Kavi Siegel · Accepted Answer · 2011-03-22 14:34:31Z

1

if($_SESSION['mystatus']!='1'){
   header("location:access_error.php");
}

answered Mar 22, 2011 at 14:34

Kavi Siegel

2,9942 gold badges26 silver badges33 bronze badges

Comments

devasia2112 · Accepted Answer · 2011-03-22 14:42:34Z

0

The follow works to me. Set the level of access in your own page, and the permissions in your database, when the user try to log in you retrieve the permission and compare with the page.

$permission = $_SESSION['PERMISSION']
$access=2; // level of access
if ($permission>$access){
    $_SESSION["pagina"]="yourPage.php";
    header("Location: accessPermission.php");
}

I hope works for you.

answered Mar 22, 2011 at 14:42

devasia2112

6,0646 gold badges41 silver badges56 bronze badges

Collectives™ on Stack Overflow

PHP login authentication problem (beginner)

4 Answers 4

1 Comment

3 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked