Member Avatar for Anati

how to admin and user to login in the same interface but after login admin will go to page register staff. while the user will go to search page staff who have been on the list by admin. what are the steps that need to be placed and coding for this situation ? please help me :(

  • 5 Contributors
  • 6 Replies
  • 128 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by hiren2927

Dani AI

Generated

The original requirement (from ) — a single login form that sends admins to a staff‑registration page and regular users to a staff‑search page — is the right idea. Several replies point toward the same simple pattern: authenticate, read a role/level, then redirect. The core gaps in the thread are secure credential handling and a robust role model.

A recommended minimal flow

  1. Store users with a hashed password and a role (for example: id, username, password_hash, role). Prefer a textual role such as admin/user or a separate roles table for future permissions.
  2. On login, fetch user by username with a prepared statement, verify the password with password_verify, call session_regenerate_id(true), set only essential session values (user_id, role) and then redirect based on role. Example (PDO + password_verify):
$stmt = $pdo->prepare('SELECT id,password_hash,role FROM users WHERE username = ?');
$stmt->execute([$username]);
$user = $stmt->fetch();
if ($user && password_verify($password, $user['password_hash'])) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['role'] = $user['role'];
    header($user['role']==='admin' ? 'Location: register_staff.php' : 'Location: search_staff.php');
    exit;
}

Security and best practices

  • Never store plaintext passwords; use password_hash/password_verify (PHP manual).
  • Use PDO or mysqli with prepared statements to avoid SQL injection (PDO prepared statements). Avoid the deprecated mysql_* API shown in 's sample.
  • Require HTTPS, limit login attempts (throttle/lockouts), protect forms with CSRF tokens, and log/monitor failed logins. Use session_regenerate_id to prevent fixation (session_regenerate_id docs). For a broader checklist see the OWASP Authentication Cheat Sheet (OWASP).

For focused debugging, include the DB schema (users table columns), the login query or code, PHP version, and exact error output or browser behavior.

Recommended Answers

All 6 Replies

Member Avatar for edbr

do you have a distinction in your database for admin?

Member Avatar for naui95

It depends on how you divide normal users from admin users in your DB. If for example you divide them let's say with a "level" value and admin is set to 0 and normal user to 1 the thing becomes quite simple! After checking the user credentials you can retrive the user level and if the level returns "0" you redirect to the admin interface and if the user level is "1" you send the user to the normal user interface.

Member Avatar for imti321

Paste your code here noone can help you this way.You have to do some thing yourself and then others can help you out.

Member Avatar for hiren2927

u just have to put condition on loginform and u can redirect ur pages to admin and user

Member Avatar for hiren2927 
<?php
session_start();
include("connection.php");
?>
<?php
$count="";
if(isset($_POST['sub']))
{
   if($_POST['txt_user']=="")
   {
      ?>
      <script>alert("please enter user name");</script>
      <?php
      $count++;
   }
   if($_POST['txt_pass']=="")
   {
   ?>
   <script>alert("please enter password");</script>
   <?php
   $count++;
   }
   }
?>
<?php
if(isset($_POST['sub']) && $count==0)
{
    $f_name=$_POST['txt_user'];
    $password=$_POST['txt_pass'];

  $select="select * from log_in where username='".$f_name."' and password='".$password."'";
  $query=mysql_query($select);
  $row=mysql_fetch_array($query);
  if($row['username']==$_POST['txt_user'] && $row['password']==$_POST['txt_pass'])
  {
    $_SESSION['f_name']=$row['username'];
    ?>
    <script>window.location="book.php";</script>
    <?php
  }
   else
     {
  ?>
  <script>alert("Username or Password Invalid");</script>
  <?php
     }
 }
?>

<form method="post">
  <table>
     <tr>
        <td colspan="2" align="center">Log In</td>
     </tr>
     <tr>
        <td>Username</td>
        <td><input type="text" name="txt_user"  ></td>
     </tr>
     <tr>
        <td>Password</td>
        <td><input type="password" name="txt_pass" ></td>
     </tr>
     <tr>
         <td colspan="2" align="center"><input type="submit" name="sub" value="Log in"></td>
     </tr>

  </table>
</form>
Member Avatar for hiren2927

just put ur query at at 'else' statement to fetch user table data than u can login to user and admin which u want

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.