Php mysQli脚本与AND运算符不按预期工作

Question

I keep writing queries that seem to never work the way I want them to. In this script, if the user who tries to login has user_level 'Admin' he should be direct to adminhome.php elseif user has user_level 'Employee' he should be directed to employeehome.php. I've created these two users Amanda with user_level Admin and Hugo with user_level 'Employee' to test the script but no matter who i'm login with, it fires $error.

login.php

<?php 
 if($_SERVER["REQUEST_METHOD"] == "POST") {

    $myusername = mysqli_real_escape_string($db,$_POST['username']);
    $mypassword = $_POST['password'];          


    $hashedPasswordQry = "SELECT password FROM users WHERE username = '$myusername'";

   $userLevel = mysqli_query($db, "SELECT user_level FROM users WHERE username='".$myusername."'");

    $result = mysqli_query($db,$hashedPasswordQry);
    $row = mysqli_fetch_array($result,MYSQLI_ASSOC);

    $count = mysqli_num_rows($result);

    // If result matched $myusername and $mypassword, table row must be 1 row
    if($count == 1 && (password_verify($mypassword, $row['password'])) && $userLevel  == 'Admin') {

        $_SESSION['login_user'] = $myusername;


        header("location: user/adminhome.php");

    }elseif($count == 1 && (password_verify($mypassword, $row['password'])) && $userLevel == 'Employee'){

           $_SESSION['login_user'] = $myusername;


        header("location: user/employeehome.php");
    }
else{
     $error = '<h5 style="text-align: center;" class="alert alert-danger" >Your username  or password is invalid</h5>';

}
}
?>

Answer 1

You're using two very similar selects, when one is only necessary. You can select multiple columns in a query by separating them with a comma SELECT this_column, that_column FROM ... And while you were executing both queries, you're only accessing the results of the password query and not the $userLevel result. A more correct version would look like:

$query = "SELECT password, user_level FROM users WHERE username = '$myusername'";

$result = mysqli_query($db, $query);
$row = mysqli_fetch_array($result, MYSQLI_ASSOC);

$count = mysqli_num_rows($result);

if($count == 1 && (password_verify($mypassword, $row['password'])) && $row['user_level']  == 'Admin')
{
    // do stuff
} elseif ($count == 1 && (password_verify($mypassword, $row['password'])) && $row['user_level'] == 'Employee')
{
    // do stuff
}