title: PHP Multi-user Login with Session
body: <p>I have 7 user levels. I will be redirected depending on my input (for example I input the credentials of the admin, i will be redirected to admin page) and same goes with the other 6. The problem I have is that after successfully logging in, if I change the url from (localhost/admin/home.php) to (localhost/employee/home.php) I can now access the employee's page. I want to have restrictions on that. Or maybe an error that says "Unauthorized user. Access denied." something like that. Here's my code.</p>
  
  <p>index.php</p>
  
  <pre><code>    &lt;form action="checklog.php" method="POST"&gt;
       &lt;h1&gt;Log in&lt;/h1&gt; 
        &lt;p&gt; 
         &lt;label for="username" class="uname" &gt; Your email or username &lt;/label&gt;
         &lt;input id="username" name="username" required="required" type="text" placeholder="myusername " minlength="2" /&gt;
        &lt;/p&gt;                          
        &lt;p&gt; 
         &lt;label for="password" class="youpasswd"&gt; Your password &lt;/label&gt;
         &lt;input id="password" name="password" required="required" type="password" placeholder="eg. X8df!90EO" minlength="2" /&gt; 
        &lt;/p&gt;                          
       &lt;input type="submit" name="submit" value="Login"&gt;
      &lt;/form&gt;
  
      &lt;?php // To display Error messages
      if(isset($_GET['err'])){
      if ($_GET['err']==1){
      echo "Invalid Credentials.";}
      else if($_GET['err']==5){
      echo "Successfully Logged out";}
      else if ($_GET['err']==2){
      echo "You're trying to access an unauthorized page.";
      }
      }
      ?&gt;
      &lt;/body&gt;
  </code></pre>
  
  <p>checklog.php (This is where I process the credentials.)</p>
  
  <pre><code>    &lt;?php
  require_once("db.php");
  function check_input($r){
      $r=trim($r);
      $r=strip_tags($r);
      $r=stripslashes($r);
      $r=htmlentities($r);
      $r=mysql_real_escape_string($r);
      return $r;
      }
  if (isset($_POST['username'],$_POST['password'])){
  
      $u=check_input($_POST['username']);
      $p=md5(check_input($_POST['password']));
      try{
      $db=get_db();
      $stmt=$db-&gt;prepare("SELECT * FROM users WHERE username=? &amp;&amp; password=?");
      $stmt-&gt;execute(array($u,$p));
      $r=$stmt-&gt;fetch(PDO::FETCH_ASSOC);
      if($r){
          session_start();
          $access_level=$r['access_level'];
          $_SESSION['username']=$r['username'];
          $_SESSION['access_level']=$access_level;
          if ($access_level==0){
              header("Location: admin/home.php");
              }
           if($access_level==1){
              header("Location: user/home.php");
              }
             if($access_level==2){
                header("Location: businesshead/home.php");
                }
              if($access_level==3){
                 header("Location: scm/home.php");
                 }
               if($access_level==4){
                  header("Location: finance/home.php");
                  }
                if($access_level==5){
                   header("Location: gm/home.php");
                   }
                 if($access_level==6){
                   header("Location: scma/home.php");
                 }
  
          }
      else{
          header("Location:index.php?err=1");
          }
      }
      catch(PDOException $e){
          die("Database error: ".$e-&gt;getMessage());
      }
  }
  else{
      header("Location:index.php");
      }
  ?&gt;
  </code></pre>
  
  <p>And lets just assume that this is my admin page (admin.php)</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;body&gt;
  
  Welcome!
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Thank you in advance!</p>