PHP login authentication problem (beginner)

Question

scenario is I have different access levels on this site, I have the simple login process working for all valid users however I am now trying to seperate the different users fo different access to pages.

here is my code at the start of my page:

// CHECKS IF THE USER HAS LOGGED IN
session_start();

if(!isset($_SESSION['logged_in']) || !$_SESSION['logged_in']){
   header("location:index.php");
}

if(!$_SESSION['mystatus']=='1'){
   header("location:access_error.php");
}

so basically I want this page to only be accessible by users with the access level of 1 if they are logged in however do not have the correct access level direct them accordingly.

at the moment it allows users who have logged in with different access levels (e.g 3) to still view this page.

help please.

many thanks,

Note that you might want to use `lower than` and `greater than` operators or bit-wise comparison. That allows for more fine-grained access control. — Lekensteyn, Mar 22 '11 at 14:37
but by using say `greater than` surely is only decent if I want all users with a higher access level to have access the page? My case being users with access level 2, should not have access to this page. — dapperwaterbuffalo, Mar 22 '11 at 14:47
In that case, you may want to look at bitwise operators. In short, each bit is a permission, and can be set to 0 (no access) or 1 (access). Next reading: [Wikipedia article](http://en.wikipedia.org/wiki/Bitwise_operation). A question about [bitwise operations in PHP](http://stackoverflow.com/q/2131758/427545). — Lekensteyn, Mar 22 '11 at 14:54

score 3 · Answer 1 · answered Mar 22 '11 at 14:34

3

!$_SESSION['mystatus'] == 1 will be interpreted as (!$_SESSION['mystatus']) == 1. As $_SESSION['mystatus'] contains values non-false values like 1 and 3, it evaluates to true !true turns into false and therefore false == 1 does not match.

Use the NOT EQUAL operator (!=):

$_SESSION['mystatus'] != 1

answered Mar 22 '11 at 14:34

Lekensteyn

64,486
22
159
192

@buymypies: if this answers your question, mark it as accepted by clicking the `v` on the left of this answer. – Lekensteyn Mar 22 '11 at 14:55

score 2 · Answer 2 · answered Mar 22 '11 at 14:36

2

if(!$_SESSION['mystatus']=='1'){

constructs like this are very dangerous, especially if you're new to PHP and haven't figured out its operator precedence rules.

This gets interpreted as "take the logic NOT of whatever's in the mystatus session variable, and compare to a string '1'."

What you want is

if ($_SESSION['mystatus'] !== '1') {

"If the mystatus variable is a string and not equal to a string of '1', then evaluate to true.

answered Mar 22 '11 at 14:36

Marc B

356,200
43
426
500

+1, people always confuse `=`, `==` and `===` and its purpose. – Jakub Mar 22 '11 at 14:37
i see no eason in using string '1' instead of number 1 – Your Common Sense Mar 22 '11 at 14:38
@Col: Me either, but that's how the OP has it. – Marc B Mar 22 '11 at 14:40

score 1 · Answer 3 · answered Mar 22 '11 at 14:34

1

if($_SESSION['mystatus']!='1'){
   header("location:access_error.php");
}

answered Mar 22 '11 at 14:34

Kavi Siegel

2,964
2
24
33

score 0 · Answer 4 · answered Mar 22 '11 at 14:42

The follow works to me. Set the level of access in your own page, and the permissions in your database, when the user try to log in you retrieve the permission and compare with the page.

$permission = $_SESSION['PERMISSION']
$access=2; // level of access
if ($permission>$access){
    $_SESSION["pagina"]="yourPage.php";
    header("Location: accessPermission.php");
}

I hope works for you.

PHP login authentication problem (beginner)

4 Answers4