PHP页面限制访问级别的访问

Question

In MySQL table I have:

1. ID
2. username
3. password
4. level

level "admin" = access to all pages
level "user" = access only to certain pages

---

In auth.php page (which is included in every page).

session_start();
if(!isset($_SESSION["username"])){
    header("Location: login.php");
    exit(); 
}

In login page I have:

session_start();

// If form submitted, insert values into the database. 
if (isset($_POST['username'])) {

    $username = stripslashes($_REQUEST['username']); // removes backslashes
    $username = mysqli_real_escape_string($conn, $username); //escapes special characters in a string
    $password = stripslashes($_REQUEST['password']);
    $password = mysqli_real_escape_string($conn, $password);

    //Checking is user existing in the database or not
    $query = "SELECT * FROM `users` WHERE username='$username' and password='" . md5($password) . "'";
    $result = mysqli_query($conn, $query) or die(mysql_error());
    $rows = mysqli_num_rows($result);
    if ($rows == 1) {
        $_SESSION['username'] = $username;
        header("Location: index.php"); // Redirect user to index.php
    } else {
        header("Location: login.php"); // Redirect user to index.php;
    }
};

How should I make two sessions, session for "admin" and session for "user", so every page would have different access level?

Answer 1

Try this!

  $query = "SELECT * FROM `users` WHERE username='$username' and password='".md5($password)."'";

    if ($result = $mysqli->query($con,$query)) {


        while ($row = $result->fetch_assoc()) {
         $_SESSION['username'] = $row["username"];
         $_SESSION['level'] = $row["level"]);
        }

        $result->free();
    }

Aftert that when a page requires a certain level just verify if the level is right.