Hi.
I am new at PHP and I am working on creating a secure website. Let me give you a quick rundown of what I currently have.
I have an index.php which is the login page. When you first visit the website, you are required to first login on this index.php. If you enter correct login information, it takes you to the specified location in the header.
However, I was curious as to how to do two things.
1.) I need to create a session so that all of my pages can only be viewed if the user is logged in. As of now, if anyone knew the complete web address for any of my other pages, they could view it, regardless of being logged in or not. I cannot figure out how to create a session and keep it running with the code I currently have. Hopefully someone can help me out!
2.) I also have a Level_access field set in my SQL database that I want to direct people to different locations based on their "access level". For example, let's say person A has access level "1". I want that person to go to the administrator main page. But person B has access level "2". I want that person to go to the members main page. Is there a way I could do that with my code as well?
Here is the code I have for the index.php...Any help is appreciated!!!
<?php
require_once('db.php');
include('functions.php');
if(isset($_POST['Login']))
{
if($_POST['username']!='' && $_POST['password']!='')
{
//Use the input username and password and check against 'users' table
$query = mysql_query('SELECT ID, Username, Active FROM users WHERE Username = "'.mysql_real_escape_strin
g($_POST['
username']
).'" AND Password = "'.mysql_real_escape_strin
g(md5($_PO
ST['passwo
rd'])).'"'
);
if(mysql_num_rows($query) == 1)
{
$row = mysql_fetch_assoc($query);
if($row['Active'] == 1)
{
session_start();
$_SESSION['user_id'] = $row['ID'];
$_SESSION['logged_in'] = TRUE;
header("Location: members.php");
}
else {
$error = 'Your user account was not activated. Please open the email that was sent and click on the activation link.';
}
}
else {
header("Location: login_fail.php");
}
}
else {
$error = 'Please enter both your username and password to access your account';
}
}
?>
<?php if(isset($error)){ echo $error;}?>
