Member Avatar for Tenaciousmug

Ok, I have my username set as 1 under admin and this other account set as 0 under admin. But it's not showing the page to any of the accounts and only showing the else statement. Does anyone know whats the problem? Im so confused and I have been staring at this code for a while now.

<?php
	include("haha.php");
	$cxn = mysqli_connect($dbhost,$dbuser,$dbpassword,$dbdatabase) or die("Couldn't connect to server");
	$sql = "SELECT `admin` FROM `Member` WHERE `username`='{$_SESSION['username']}'";
	$result = mysqli_query($cxn,$query) or die(mysqli_error($cxn));
	$row = mysqli_fetch_array($result);
	if($row['admin'] == 1)
	{
There is code here that shows the page, but that works fine and I already tested it so I wont hog up the space with it. xD
}
}else{
echo "You aren't allowed to view this page because you are not admin.<br>
Click <a href='explore.php'>here</a> to go back to the site!";
}
?>
  • 2 Contributors
  • 3 Replies
  • 132 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by Tenaciousmug

Dani AI

Generated

A simple variable mix-up is the root cause here — as discovered, the query string was built into one variable but another (undefined) variable was passed to the database call. ’s point about backticks is also worth noting: backticks quote identifiers in MySQL (they are optional for ordinary names), while single quotes are for string literals. To avoid spending hours hunting this kind of bug, use the checks below.

Quick checklist for similar problems

  • Turn on development error reporting so undefined variables and warnings show up: this catches typos early.
  • Ensure session_start() runs before reading $_SESSION data.
  • After calling the DB, test the result for false and log mysqli_error() (or PDO exceptions) instead of assuming success.
  • Verify the query returned a row before accessing columns (check row count or whether fetch returned false).
  • Compare the admin value as an integer (cast it) or use a strict comparison to avoid type surprises.
  • Use prepared statements to eliminate injection risks and to separate query text from data.

Example of a safer pattern (PDO, prepared statement)

$pdo = new PDO(..., [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$stmt = $pdo->prepare('SELECT admin FROM Member WHERE username = :u LIMIT 1');
$stmt->execute([':u' => $username]);
$admin = (int)$stmt->fetchColumn();
if ($admin === 1) { /* admin page */ } else { /* deny */ }

Final notes: avoid echoing database or authentication internals to users. Add a unique index on username, use LIMIT 1, and log failed queries during development. See the PHP docs on prepared statements and session handling for implementation details: PDO prepared statements and session_start.

Recommended Answers

All 3 Replies

Member Avatar for EvolutionFallen

Why do you have backticks around "admin", "Member", and "username"? I've never seen those used in a SQL statement, but maybe I'm just ignorant. In any case, try

$sql = "SELECT admin FROM Member WHERE username='{$_SESSION['username']}'";

and see if that works.

Member Avatar for Tenaciousmug

No it doesn't. This one professional guy told me to do it because thats how you should code it so it looks professionally done.. ? I dont know.

Member Avatar for Tenaciousmug

Nevermind it was a simple variable mistake. I had $sql and instead I was trying to result the $query and $cxn. xD And there was no $query variable.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.