title: PHP sessions (user/admin) user levels
body: <p>I am only new to php, a few weeks self teaching myself and making various projects to learn how to do things...</p>
  
  <p>I am currently making a basic project consisting of...
  index (login page)
  register
  home (user level)
  admin (admin level)
  logout
  dbconnect</p>
  
  <p>I have a column in my db called userlevel with 0 as default and i will change to 1 for admin accounts....</p>
  
  <p>at the moment any user that logs in can access the home.php page because the session variable is 'user' so as long as any user is logged in they go to home.php or else return to index if login is not valid.... like i said i am very new to php and only began learning about sessions today so its all a bit overwhelming... basically i just pasted the same page from home to admin to begin editing the session details so that it will only allow users with userlevel 1 to access admin else back to index.... my code for the relevant pages is as follows.....</p>
  
  <p>index.php (login page)
  <div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?php
   ob_start();
   session_start();
  
   require_once 'dbconnect.php';
  
  
   
   // it will never let you open index(login) page if session is set
   if ( isset($_SESSION['user'])!="" ) {
    header("Location: home.php");
    exit;
   }
   
   $error = false;
   
   if( isset($_POST['btn-login']) ) { 
    
    // prevent sql injections/ clear user invalid inputs
    $email = trim($_POST['email']);
    $email = strip_tags($email);
    $email = htmlspecialchars($email);
    
    $pass = trim($_POST['pass']);
    $pass = strip_tags($pass);
    $pass = htmlspecialchars($pass);
    // prevent sql injections / clear user invalid inputs
    
    if(empty($email)){
     $error = true;
     $emailError = "Please enter your email address.";
    } else if ( !filter_var($email,FILTER_VALIDATE_EMAIL) ) {
     $error = true;
     $emailError = "Please enter valid email address.";
    }
    
    if(empty($pass)){
     $error = true;
     $passError = "Please enter your password.";
    }
    
    // if there's no error, continue to login
    if (!$error) {
     
     $password = hash('sha256', $pass); // password hashing using SHA256
    
     $res=mysql_query("SELECT id, fname, pass FROM project WHERE email='$email'");
     $row=mysql_fetch_array($res);
     $count = mysql_num_rows($res); // if uname/pass correct it returns must be 1 row
     
     if( $count == 1 &amp;&amp; $row['pass']==$password ) {
      $_SESSION['user'] = $row['id']; 
      header("Location: home.php");
     } else {
      $errMSG = "Incorrect Credentials, Try again...";
     }
  
      
    }
    
   }
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
  &lt;title&gt;Sign In&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  
  &lt;form method="post" action="&lt;?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?&gt;" autocomplete="off"&gt;
  
  
  &lt;input type="email" name="email" placeholder="Enter Your Email" value="&lt;?php echo $email; ?&gt;" maxlength="40" /&gt;
  &lt;?php echo $emailError; ?&gt;&lt;br&gt;
  
  &lt;br&gt;
  
  &lt;input type="password" name="pass" placeholder="Enter Your Password" maxlength="15" /&gt;
  &lt;?php echo $passError; ?&gt;&lt;br&gt;
  
  &lt;br&gt;
  
  &lt;button type="submit" name="btn-login"&gt;Sign In&lt;/button&gt;&lt;br&gt;
  
  
  &lt;br&gt;
  &lt;br&gt;
  &lt;a href="register.php"&gt;Register&lt;/a&gt; &lt;a href="index.php"&gt;Sign in&lt;/a&gt; &lt;a href="admin.php"&gt;Admin&lt;/a&gt;
  &lt;br&gt;
  &lt;?php
  if ( isset($errMSG) ) {
  
  ?&gt;
   &lt;?php echo $errMSG; ?&gt;
  
  &lt;?php
  }
  ?&gt;
  
  
  &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php ob_end_flush(); ?&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>home.php</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?php
   ob_start();
   session_start();
   require_once 'dbconnect.php';
  
   
   // if session is not set this will redirect to login page
   if( !isset($_SESSION['user']) ) {
    header("Location: index.php");
    exit;
   }
   // select loggedin users detail
   $res=mysql_query("SELECT * FROM project WHERE id=".$_SESSION['user']);
   $userRow=mysql_fetch_array($res);
  
  
  
  
   
  ?&gt;
  
  
  
  
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
  &lt;title&gt;Welcome - &lt;?php echo $userRow['fname']; ?&gt;&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  Hello &lt;?php echo $userRow['fname']; ?&gt; you are sucessfully logged in!
  
  &lt;br&gt;Your last name is &lt;?php echo $userRow['lname']; ?&gt;
  &lt;br&gt;Your email address is &lt;?php echo $userRow['email']; ?&gt;
  
  &lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;
  
  
  
  
  
  
  
  &lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;
  
  
  &lt;a href="logout.php?logout"&gt;&lt;/span&gt;Sign Out&lt;/a&gt;&lt;/li&gt;
  
  
  &lt;br&gt;
  &lt;br&gt;
  &lt;a href="register.php"&gt;Register&lt;/a&gt; &lt;a href="index.php"&gt;Sign in&lt;/a&gt; &lt;a href="admin.php"&gt;Admin&lt;/a&gt;
               
  &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php ob_end_flush(); ?&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>admin.php</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;?php
   ob_start();
   session_start();
  
   require_once 'dbconnect.php';
  
   
   
   // if session is not set this will redirect to login page
   if( !isset($_SESSION['user']) ) {
    header("Location: index.php");
    exit;
   }
  
   // select loggedin users detail
   $res=mysql_query("SELECT * FROM project WHERE id=".$_SESSION['user']);
   $userRow=mysql_fetch_array($res);
  
  
  
  
   
  ?&gt;
  
  
  
  
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=utf-8" /&gt;
  &lt;title&gt;Welcome - &lt;?php echo $userRow['fname']; ?&gt;&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  
  Hello &lt;?php echo $userRow['fname']; ?&gt; you are sucessfully logged in!
  
  &lt;br&gt;Your last name is &lt;?php echo $userRow['lname']; ?&gt;
  &lt;br&gt;Your email address is &lt;?php echo $userRow['email']; ?&gt;
  
  &lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;
  
  
  &lt;h1&gt;&lt;?php echo $userRow['userlevel']; ?&gt;&lt;/h1&gt;
  
  
  
  
  
  &lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;
  
  
  &lt;a href="logout.php?logout"&gt;&lt;/span&gt;Sign Out&lt;/a&gt;&lt;/li&gt;
  
  &lt;br&gt;
  &lt;br&gt;
  &lt;a href="register.php"&gt;Register&lt;/a&gt; &lt;a href="index.php"&gt;Sign in&lt;/a&gt; &lt;a href="admin.php"&gt;Admin&lt;/a&gt;
               
  &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php ob_end_flush(); ?&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>If someone can tell me how to make the session look to the userlevel row in the DB to pull the stored info (0 or 1 for user or admin) and also how to alter the index.php (login) page accordingly, and how to edit admin.php to only allow logged in users with userlevel 1 to view the page?</p>
  
  <p>Sorry if this is vague or all over the place, i am still only finding out new stuff each day </p>
  
  <p>Thanks</p>