Member Avatar for aianne

Hello everyone! I am a student and still a noob in PHP. Well, I'm trying to figure out what is the best method for a log in page system that provide the ability for an Administrator to log in using the same log in form for normal users but get redirected to a administrator page if the system recognize as Admin and normal users redirected to users page. Any idea? Any help would be greatly appreciated! :) Here is my log in code for users -->

<?php
    //Start session
    session_start();

    //Include database connection details
    require_once('voting_connect.php');

    //Array to store validation errors
    $errmsg_arr = array();

    //Validation error flag
    $errflag = false;

    //Connect to mysql server
    include('voting_connect.php');
{


    //Select database
    $db = mysql_select_db($db);
    if(!$db) {
        die("Unable to select database");
    }

    //Function to sanitize values received from the form. Prevents SQL injection
    function clean($str) {
        $str = @trim($str);
        if(get_magic_quotes_gpc()) {
            $str = stripslashes($str);
        }
        return mysql_real_escape_string($str);
    }

    //Sanitize the POST values
    $s_ID = clean($_POST['s_ID']);
    $s_Password = clean($_POST['s_Password']);

    //Input Validations
    if($s_ID == '') {
        $errmsg_arr[] = 'ID number missing';
        $errflag = true;
    }
    if($s_Password == '') {
        $errmsg_arr[] = 'Password missing';
        $errflag = true;
    }

    //If there are input validations, redirect back to the login form
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: login.php");
        exit();
    }

    //Create query
    $qry="SELECT * FROM students WHERE s_ID='$s_ID' AND s_Password='$s_Password'";
    $result=mysql_query($qry);

    //Check whether the query was successful or not
    if($result) {
        if(mysql_num_rows($result) == 1) {
            //Login Successful
            session_regenerate_id();
            $member = mysql_fetch_assoc($result);
            $_SESSION['SESS_MEMBER_ID'] = $member['s_ID'];
            $_SESSION['SESS_FIRST_NAME'] = $member['s_FirstName'];
            $_SESSION['SESS_LAST_NAME'] = $member['s_LastName'];

            session_write_close();
            header("location: vote.php");
            exit();
        }else {
            //Login failed
            header("location: logfail.php");
            exit();
        }
    }else {
        die("Query failed");
    }
    }
?>
  • 2 Contributors
  • 1 Reply
  • 209 Views
  • 3 Hours Discussion Span
  • Latest Post Latest Post by DarkMonarch

Dani AI

Generated

A single login form is the right idea — submit credentials only, authenticate on the server, and redirect based on a role or permission stored with the account. ’s single-form flow is appropriate; ’s drop-down idea is useful for UX but must never be trusted as the authority on permissions because client-supplied values can be forged.

Several gaps in the posted approach should be addressed. Passwords must be stored hashed (use password_hash when creating accounts and passwordverify for checks). The old mysql* API should be replaced with prepared statements via PDO or mysqli to avoid SQL injection. Sessions should be hardened: regenerate the session id on login, store only minimal session data (id and role), and set session cookie flags (HttpOnly, Secure) along with HTTPS in production. Redirects are convenience, not authorization — every protected page (especially admin pages) must verify the session role on every request.

Example of the server-side decision logic (use with PDO and a hashed password column):

$stmt = $pdo->prepare('SELECT id, first_name, last_name, password_hash, role FROM users WHERE id = ?');
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($password, $user['password_hash'])) {
    session_regenerate_id(true);
    $_SESSION['SESS_MEMBER_ID'] = $user['id'];
    $_SESSION['SESS_FIRST_NAME'] = $user['first_name'];
    $_SESSION['SESS_LAST_NAME'] = $user['last_name'];
    $_SESSION['role'] = $user['role'];
    header('Location: ' . ($user['role'] === 'admin' ? 'admin.php' : 'vote.php'));
    exit;
}

Final notes: never trust hidden inputs or client-side role selectors for access control; enforce deny-by-default on protected pages; add logging, brute-force protection (rate limiting/account lockout), and centralize permissions (simple role column is fine for two roles; consider RBAC for finer control).

Member Avatar for DarkMonarch

what we have at work is 1 form for all, admins, clients and operators.

they have to enter their log and pass and select an option on a drop list before the submit button. depending on their selected option and their authentification, the main core of the app. is changed to their level.

i didnt have to work with that part of the code yet, so i didnt get the chance to look at it and tell you how they done it. ive only been brief on it.

but i imagine they have a table that check password and access level to authenticate the users. And i would passed an hidden="tag-admin" to make sure they have access rights.

anyways thats the way i would do it.

good luck

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.