asked on

Restricting access to PHP pages

I am building (or trying to!) a password restricted site where different user-levels see different content.

I am using the code attached below to start the session, login and display the relevant pages according to the users status.

The problem is that none of the pages are restricted so for example if a member logs in they are shown the links...'Change Password', 'Log out', and 'Admin'

But non members can still see these pages if they navigate directly to the URL.

It seems as if the code below only displays links according to user level but does not offer any restrictions to those pages.

How would I add this? It would simply need to be a function that redirects users to a login page if they are not logged in.

<div id="AdminMenu">

<?php # Script 16.1 - header.html
// This page begins the HTML header for the site.

// Start output buffering:
ob_start();

// Initialize a session:
session_start();


?><?php

// Displaylinks based upon thelogin status:

if (isset($_SESSION['user_id'])) {
	
	echo 'Welcome';
	
	if (isset($_SESSION['first_name'])) {
		echo ", {$_SESSION['first_name']}!&nbsp";
		
		}

echo '<a href="logout.php" title="Logout">Logout</a>&nbsp;

<a href="change_password.php" title="Change Password">Change Password</a>

';

// Add links if the user is an administrator:

if ($_SESSION['user_level'] == 1) {

echo '<a href="admin/test.php" title="Admin">Admin</a>&nbsp;

';

}

} else

 { // Not loggin in.



echo '<a href="joinanjoman.php" title="Join Anjoman">Join</a>&nbsp;

<a href="login.php"
title="Login">Login</a><br />


';

}

?>

</div>

Open in new window

Hugh McCurdy

Put the restrictions on each page you want protected.

ASKER CERTIFIED SOLUTION

Hugh McCurdy

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Gary Coltharp

How are you keeping track of your users? Are using a database connection of some sort?

PHP is server side so you can query the logged in user against the database and display links based on the return.

Hope this helps.

SOLUTION