title: Directory Application Security
body: <p>So, I have two types of users who may login or register: merchants or buyers.</p>
  
  <p>When I login as a buyer, using: <code>action="check_buyer.php"</code>, it redirects me to <code>login/buyer/</code> on my website. But, right now, once logged in I can change the url from <code>login/buyer</code> to <code>login/merchant</code> and it works. How do I prevent this? As you can see I'm using sessions...</p>
  
  <p>How do I implement below in PHP a check for <code>$_POST['userPermission'];</code> that would be stored as INT(1) in the database and called upon in my sessions ??</p>
  
  <pre><code>&lt;?php
  session_start(); #recall session from index.php where user logged include()
  
  require_once('../inc/db/dbc.php');
  $connect = mysql_connect($h, $u, $p) or die ("Can't Connect to Database.");
  mysql_select_db($db);
  
  $LoginUserName = $_POST['userName'];
  $LoginPassword = mysql_real_escape_string($_POST['userPass']);
  //connect to the database here
  $LoginUserName = mysql_real_escape_string($LoginUserName);
  $query = "SELECT uID, uUPass, dynamSalt
          FROM User
          WHERE uUName = '$LoginUserName';";
  $result = mysql_query($query);
  if(mysql_num_rows($result) &lt; 1) //no such USER exists
  {
      echo "Invalid Username and/or Password";
  }
  $ifUserExists = mysql_fetch_array($result, MYSQL_ASSOC);
  
  $dynamSalt = $ifUserExists['dynamSalt'];  #get value of dynamSalt in query above
  $SaltyPass = hash('sha512',$dynamSalt.$LoginPassword); #recreate originally created dynamic, unique pass
  
  if($SaltyPass != $ifUserExists['uUPass']) # incorrect PASS
  {
      echo "Invalid Username and/or Password";
  }
  
  else {
  validateUser();
  }
  // If User *has not* logged in yet, keep on /login
  if(!isLoggedIn())
  {
      header('Location: index.php');
      die();
  }
  
  function validateUser()
  {
      session_regenerate_id ();
      $_SESSION['valid'] = 1;
      $_SESSION['uID'] = $userid;
  }
  
  function isLoggedIn()
  {
      if(isset($_SESSION['valid']) &amp;&amp; $_SESSION['valid'])
          header( 'Location: buyer/' ); # return true if sessions are made and login creds are valid
      echo "Invalid Username and/or Password";  
      return false;
  }
  ?&gt;
  </code></pre>