Distinguishing between ADMIN and USER logic error
<p>I'm having a problem with one of my PHP scripts. I am trying to distinguish between two test users on my site for the eventual goal of displaying some content for administrators and some for just normal users.</p>

<p>I have written the authentication scripts below and the logic seems sound but the users are always identified as just 'Normal Users' when I have hard coded my test data to make them distinctively different (one admin, one user). </p>

<p>Here is userauth.php:</p>

<pre><code>    $username = pg_escape_string($_POST["username"]); // USERNAME = EMAIL
    $password = pg_escape_string($_POST["password"]);
    $conn = pg_connect("database string") // FILLED IN REALITY

    $loginsql = "SELECT * FROM mfbusers WHERE password='$password' AND email='$username'";
    $loginres = pg_query($loginsql);
    $numrows = pg_num_rows($loginres);

    if($numrows == 1){
            $loginrow = pg_fetch_assoc($loginres);

            $_SESSION['SESS_LOGGEDIN'] = 1;
            $_SESSION['SESS_NAME'] = $loginrow['username'];

            header("Location: http://users.aber.ac.uk/dwd/mfb/php/user.php");
    }

    elseif ($numrows == 0) {
            header("Location: http://users.aber.ac.uk/dwd/mfb/php/loginerror.php"); 
    }
</code></pre>

<p>And here is user.php:</p>

<pre><code>    $conn = pg_connect("database string"); //FILLED IN REALITY

    $username = pg_escape_string($_POST["username"]);
    $password = pg_escape_string($_POST["password"]);

    $sql = ("SELECT * FROM mfbusers WHERE email='$username' AND password='$password' AND isadmin='t'");
    $res = pg_query($sql);
    $numrows = pg_num_rows($res);

    if($numrows == 1) //IF TRUE
    {
            echo "YOU ARE A POWER USER!";
    }
    else // IF FALSE
    {
            echo "YOU ARE A NORMAL USER!";
    }
</code></pre>

<p>I think the problem lies in user.php but I can't seem to figure it out. </p>

<p>Finally the datatable I'm using is set up like this</p>

<pre><code>u_id | name | username | password | email | isadmin
-----+------+----------+----------+-------+---------
1    |Daniel| dwd01    | hello    | dan@me.com | f
-----+------+----------+----------+-------+---------
2    |Tom   | tjp01    | goodbye  | tom@him.com | t
</code></pre>

<p>The problem is that Dan is correctly identified as a Normal User because isadmin is false. But Tom is also identified as a normal user when his isadmin is true. I'm really confused as to why that is.</p>

<p>Any help is much appreciated. Thanks.</p>
