PHP - session multi user and admin privileges

It seems from your question that you'll use the same login page for both administrative users and non-administrative users. That's the case for which I'll offer an answer.

In the process of validating a particular user's name and password, you need to determine what privilege level that user has been granted. You might have a column called "privilege" in your user table.

usr_tbl needs to look something like this:

 id    username     password    privilege
  1      admin      W$^%^$%^%^%  admin
  2      reggel     DJDT&646364  user
  3      ollie      DTHDHFGEERT  user

Upon login, you'l read the usr_table and pull that user's value out of the column and store it as a session variable something like this:

 $_SESSION['privilege'] = $privilege; /* from user table */

Then you can do logic like this to decide what your user should see, and what she should be able to do.

 if ( 'admin' == $_SESSION['privilege'] ) {
    // Jump to secured page
    header('Location: index_admin.php');
 }
 else {

    // Jump to login page
    header('Location: index.php');
}

In later page views, if your session logic is functioning correctly, the $_SESSION['privilege'] variable should continue to be available.

p.s. mysql_ APIs for security code? Really?

• You need to add a new field in your database for user type (admin/normal_user).
• In your login script save the user type in session (admin/normal_user).
• Now on every top of page check the session value of user type if it is admin let the page open and if it is normal_user redirect page to login.

ideally you need to expand on the data structure serving this code: Set up a table of users and a table of groups; the groups will imply access rights. When you submit the login page, check the database for the username, then:-

1) If no match, return to "access denied" screen

2) if match, xref with groups table to determine privilege level of this user. Then:- 2a) if admin, return to admin screen, setting appropriate session vars to store that decision. 2b) Else, return to normal user screen, ditto setting appropriate session vars.

Your core problem is that upon entering "the" homepage, you are simply checking if the username is set, and then taking the user to the admin screen. This is wrong. Try to split out your logic into smaller simpler steps, and consider the "if-else" logic in human terms. "What do I want to happen?" then "What do I need to know to ascertain how to do that?".

Good luck!

I use the same but I got one error

This page does not work local host has redirected you too often. Try clearing your cookies. ERR_TOO_MANY_REDIRECTS

    <?php

// Include config file
require_once "config.php";

// Initialize the session
session_start();

// Check if the user is logged in, if not then redirect him to login page
if(!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true){
    header("location: login.php");
    exit;
}

$_SESSION['privilege'] = $privilege; /* from user table */

if ( 'admin' == $_SESSION['privilege'] ) {
    // Jump to secured page
    header('Location: index_admin.php');
 }
 else {

    // Jump to login page
    header('Location: index.php');
}

?>

<?php include "theme/header.tpl"; ?> 

    <div class="page-header">
        <h1>Hi, <b><?php echo htmlspecialchars($_SESSION["username"]); ?></b>. Welcome to our site.</h1>
    </div>
    <p>
        <a href="reset-password.php" class="btn btn-warning">Reset Your Password</a>
        <a href="logout.php" class="btn btn-danger">Sign Out of Your Account</a>
        <a href="users.php" class="btn btn-success">Users </a>       
    </p>


<?php include "theme/footer.tpl"; ?>