Multilevel Login in PHP

Question

I have php code for login, it is worked if i input just username and password, but i need to check it with column hak_akses. For example if i login with hakakses = Dosen, the response says "Login Berhasil", if i login with hakakses = TU, the response says "Login Failed"

This is my code login php

<?php

 $con = new mysqli("localhost","root","","komplain");
 if($con->connect_error)
 {
    die("Connection Failed: " .$con->connect_error);
 }

 $response = array();

 if(isset($_GET['apicall']))
 {
    switch ($_GET['apicall']) {
    case 'signup':
        # code...
        break;
    case 'login':
        if(isParameterAvailable(array('username','password')))
        {
            $username = $_POST['username'];
            $password = password_hash($_POST['password']);

            $stmt = $con->prepare("SELECT id_user, username, email, no_telp FROM user WHERE username = ? AND password = ?");
            $stmt->bind_param("ss",$username,$password);
            $stmt->execute();
            $stmt->store_result();

                if($stmt->num_rows > 0)
                {
                    $stmt->bind_result($id,$username,$email,$no_telp);
                    $stmt->fetch();

                    $user = array(
                        'id'=>$id,
                        'username'=>$username,
                        'email'=>$email,
                        'no_telp'=>$no_telp
                    );
                    $response['error'] = false;
                    $response['message'] = "Login Berhasil";
                    $response['user'] = $user;
                }
                else
                {
                    $response['error'] = false;
                    $response['message'] = "Username / Password Salah";
                }
            }
        break;

    default:
        $response['error'] = true;
        $response['message'] = 'Invalid Operation Called';

        }
   }
   else
   {
      $response['error'] = true;
      $response['message'] = 'Invalid API call';
   }
   echo json_encode($response);
?>

This is my database enter image description here

This is response from postman enter image description here

My question is what should i do if i need to check login with hakakses(level user) ? This code is just simulation, i am not using this code for my project, so i want to know how to login with multilevel user base on my code

Sorry for my English

Thank You

Answer 1

You should use password_hash() for PHP versions less than 5.5.
I'm using PHP 7.0 and I'm using hash() with a salt for extra security.
I'm first looking for the user inside the db based on username/email and then compare the password with the hashed entered password.
In that way you can show an invalid password error or even a user not found error.

    $stmt = $con->prepare("SELECT id_user, username, email, no_telp, password, salt FROM user WHERE username = ? ");
    $stmt->bind_param("ss",$username);
    $stmt->execute();
    $login_ok = false; 
    $row = $stmt->fetch(); 
    if($row){ 
        $check_password = hash('sha256', $row['password'] . $row['salt']); 
        if($check_password === $row['password']){
            $login_ok = true;
        } 
        else{
           // invalid password
        }
    }
    else {
       // no user found
    }

Based on $login_ok you can do stuff like showing errors

By creating a new user you should add the hashed password + the salt inside the db.
First generate a new salt:

$salt = dechex(mt_rand(0, 2147483647)) . dechex(mt_rand(0, 2147483647)); 

And save the password into the db like this:

hash('sha256', $password . $salt)

Also don't forget to add the salt itself to the db.

Answer 2

Okay i find a solution. First i changed my code to this

<?php

$con = new mysqli("localhost","root","","tugas_akhir");
if($con->connect_error)
{
   die("Connection Failed: " .$con->connect_error);
}

$response = array();

$username = $_POST['username'];
$password = $_POST['password'];

$login = mysqli_query($con,"SELECT * from user WHERE username='$username'and password='$password'");
$cek = mysqli_num_rows($login);

if ($cek > 0) {

while($data = mysqli_fetch_assoc($login))
{
    $id = $data['id_user'];
    $email = $data['email'];
    $hak = $data['hak_akses'];
    $no_telp = $data['no_telp'];

    if ($data['hak_akses'] == "Dosen") {

        $user = array(
        'id_user'=>$id,
        'username'=>$username,
        'email'=>$email,
        'hak_akses'=>$hak,
        'no_telp'=>$no_telp);

        $response['error'] = false;
        $response['message'] ="Berhasil Login";         
        $response['user'] = $user;
    }
    else{
        $response['error'] = true;
        $response['message'] = "Tidak Mempunyai Akses";

    }
  }
}
else{
       $response['error'] = true;
       $response['message'] = "Username/Password Salah";
}

echo json_encode($response);
?>

I use mysqli_fetch_assoc() to retrieve data from database. And then i store data with $data

If user input is true, the message is Berhasil Login(Successful), else the message is Tidak Punya Akses(Access Denied) because i give statement if($data['hak_akses'] == "Dosen")