Help with my login script

[JonnyB]

Hi all,

I've got three types of users. When they log in i want them to go to a different page dependent on the type of user.

Its nearly workin but does anyone have any idea why the teacher check is workin but the student check isn't?

Also would using sessions be a better solution than using the include( ' ' ).

<?php
$host="localhost"; // Host name 
$username="student1"; // Mysql username 
$password="student1"; // Mysql password 
$db_name="wep"; // Database name 
$tbl_name="user_tbl"; // Table name 

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// check username and password
$sql="SELECT * FROM $tbl_name WHERE User_id='$myusername' and User_pass='$mypassword'";
$result=mysql_query($sql);
$rows = mysql_num_rows($result);

// if match found login
if($rows==1){

//check to see if student
    $sql="SELECT * FROM user_tbl, student_tbl WHERE user_tbl.User_id='$myusername' AND student_tbl.User_id='$myusername'";
	$result=mysql_query($sql);
	$rows = mysql_num_rows($result);
 
 //if == 1 user is a student
 if($rows==1){
   include( 'teacher.php' );
   }
 else{
    //check to see if teacher
    $sql="SELECT * FROM user_tbl, teacher_tbl WHERE user_tbl.User_id='$myusername' AND teacher_tbl.User_id='$myusername'";
	$result=mysql_query($sql);
	$rows = mysql_num_rows($result);
	  if($rows==1){
	    include( 'teacher.php' );
        }
	  else{
	    //user is an employer
		include( 'employer.php' );
		 }
	  }
}
//else check username
else{
  $sql="SELECT * FROM $tbl_name WHERE User_id='$myusername'";
  $result=mysql_query($sql);
  $rows = mysql_num_rows($result);
  
  // if == 1 username ok so password wrong
  if($rows==1){
    echo "Invalid password entered";
	}
   // wrong username
   else{
    echo "Invalid username entered";
	}
}

?>

[quill]

Hi,

How about this logic:

You have a table called "users"

In that, you have their details, such as first name, last name, username, password and you add "type".

"type" is an INT.

Now you make another table called "types" with the fields: id,name,url.

(I'm doing this off the top of my head).

So when the user submits the form information you have something like:

if(isset($_POST['submit'])) {

$username = $_POST['username'];
$password = $_POST['password'];
$e1 = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$e2 = mysql_query($e1,$conn) // conn is your connection variable to mysql
if(mysql_num_rows($e2)==1) {
die('Invalid username and password combination');
}
// If there is a match, continue on
$e3 = mysql_fetch_array($e2);
// Get their type
// 1 = student, 2 = teacher (you would have this in users database
$type = $e3['type'];
// So now we have their type and now we look up to see what to do with them

$r1 = "SELECT * FROM types WHERE id = '$type'" // remember type is an INT
$r2 = mysql_query($r1,$conn);
$r3 = mysql_fetch_array($r2);
$url = $r3['url'];
// Now we can take them to whatever page they are set to
header("Location: $url");
}

Using this code, you can add as many types as you like, each with a different URL to go to.

Have a look at http://www.devshed.com/c/a/PHP/Creat...-Login-Script/ or just type into google something like: php mysql secure login

[JonnyB]

Cheers Quill,

Thats not quite what i was after the way i'm doin it is to have a user table, student table, teacher table and employer table the later three with forgien keys to user table and working their user type out through that.

I dont think there's anything wrong with the method just the code thats not quite working right.

There's something wrong with the student check sql section and i'm not to sure why as the same is working for the teacher check.

Also i'm not sure if i'm using the best way to direct them to the page. I noticed you used the header() method using laction in it. I've not had much luck using that. How does it work?

Thanks again, Jonny.

[JonnyB]

I manged to sort this problem. Turns out there's nothing wrong with the code I'd forgot to input the student details in to the student table of the database so the user existed but wasnt finding the match.

My bad!