title: Login page not preventing invalid usernames
body: <p>I have a form with only a username that will allow for access to two pages depending an users authority level in an MS SQL database. </p>
  
  <p>If their authority level is 10 then they will log into the 'normal' page, however anything more and they will be logged into an admin page with more functionality. This all works fine, however It's letting anything typed into the username to log in. </p>
  
  <p>I'm struggling to prevent it logging in any username that isn't in the database. This is what I have so far...</p>
  
  <pre><code>$conn = odbc_connect(database connection stuff here);
  $login = $_POST['login'];
  $sqlquery = "SELECT u.authorityLevel, u.employeeNo, e.knownAs FROM common.dbo.users as u JOIN 
  common.dbo.employees AS e on e.employeeNo = u.employeeNo WHERE u.employeeNo = '".$login."'";
  $result = odbc_exec($conn, $sqlquery);
  $user = odbc_fetch_array($result);
  $userExists = odbc_num_rows($sqlquery);
  
  if((isset($_SESSION['login']['logged_in']) &amp;&amp; $_SESSION['login'] 
  ['logged_in'])==true){
  
  if(isset($_POST)){
    if ((int)$user['authorityLevel'] &gt; 10) {
      header("location: indexAdmin.php");
      $row = $user;
      $_SESSION['sessionUserName'] = $row['knownAs'];
  } elseif ((int)$user['authorityLevel'] = 10) {
      header("location: confirmedJobs.php");
      $row = $user;
      $_SESSION['sessionUserName'] = $row['knownAs'];
  } else ((int)$user['authorityLevel'] &lt; 10){
      header("location: loginPage.php");
    }
   }
  }
  </code></pre>