0

Hey I am trying to do login based on role like (admin,user)

Login works fine but if I want to check user role it don't work.

<?php
$host     = "localhost";
$user     = "root";
$password = "";
$database = "dbtest";
$db       = new mysqli($host, $user, $password, $database);
session_start();
if ($_POST['username'] != "" && $_POST['password'] != ""):
                extract($_POST);
                $username     = mysqli_real_escape_string($db, $_POST['username']);
                $pass_encrypt = md5(mysqli_real_escape_string($db, $_POST['password']));
                $fetch        = $db->query("SELECT * FROM `users` WHERE username='$username' AND `password` = '$pass_encrypt'");
                $count        = mysqli_num_rows($fetch);
                if ($count == 1):
                                $row                        = mysqli_fetch_array($fetch);
                                $_SESSION['login_username'] = $row['username'];
                                $_SESSION['sess_userrole']  = $row['role'];
                //echo $_SESSION['sess_userrole'];

                //session_write_close();
                                if ($_SESSION['sess_userrole'] == "admin") {
                                                header('Location: admin_page.php');
                                } else {
                                                header('Location: user_page.php');
                                }
                                echo 1;
                else:
                                echo 0;
                endif;
else:
                header("Location:lg.php");
endif;
?>

My table looks like id, username, password, role ( where password is a md5 hash)

Radekesd
  • 13
  • 3
  • 1
    What value do you get if you un-comment the echo $_SESSION['sess_userrole'] line? – H2ONOCK Feb 19 '17 at 10:28
  • First all of don't use `MD5` because [link](http://security.stackexchange.com/questions/19906/is-md5-considered-insecure) . Second prefer prepare statement [link](http://stackoverflow.com/questions/24988867/when-should-i-use-prepared-statements/24989031). Third is `$_SESSION` variable work when you refreshed the page so first time checking i suggest you to use `$row[role]` for heading according role page – gaurav Feb 19 '17 at 11:03
  • @H2ONOCK I got nothing – Radekesd Feb 19 '17 at 11:15

0 Answers0