login page php wouldnt redirect

[leesyaa]

hi, im trying to make a login page that call the user from two different table (admin & user). it doesnt have any error but it somehow doesnt link to the required page.


login.php

if(isset($_POST['submit']))
	{	
		include 'connection.php';
		
		$username = trim(addslashes($_POST['username']));
		$password = trim(addslashes($_POST['password']));
		
		if ($username != '' && $password != '') 
		{
			
			$sql = "SELECT * FROM admin
						WHERE admin_username = '$username' AND admin_password = '$password'";
			$result = mysql_query($sql) or die('Query failed. ' . mysql_error());
			$row = mysql_fetch_array($result, MYSQL_ASSOC);
			
			if (mysql_num_rows($result) == 1) 
			{
				$_SESSION['admin_name']=$row['admin_name'];
				$_SESSION['admin_addr']=$row['admin_addr'];
				$_SESSION['admin_position']=$row['admin_position'];	
				$_SESSION['admin_ic']=$row['admin_ic'];
									
				if(isset($_SESSION['admin_username']) && $_SESSION['admin_username'] === TRUE )
				{
					print "<script>";
					print "window.alert('Welcome Admin'); self.location='admin.php';"; 
					print "</script>";						
				}
				else
				{
				echo "<script languange = 'Javascript'>
				alert('please check again!!');
				location.href = 'login.php';</script>";
				}																	
			}
		}
	} 
						
		
		if(isset($_POST['submit']))
		{	
			include 'connection.php';
		
			$username = trim(addslashes($_POST['username']));
			$password = trim(addslashes($_POST['password']));
		
			if ($username != '' && $password != '') 
			{
			
				$sql = "SELECT * FROM staff
							WHERE staff_username = '$username' AND staff_password = '$password'";
				$result = mysql_query($sql) or die('Query failed. ' . mysql_error());
				$row = mysql_fetch_array($result, MYSQL_ASSOC);
			
				if (mysql_num_rows($result) == 1) 
				{
					$_SESSION['staff_name']=$row['staff_name'];
					$_SESSION['staff_addr']=$row['staff_addr'];
					$_SESSION['staff_position']=$row['staff_position'];	
					$_SESSION['staff_ic']=$row['staff_ic'];
									
					if ($_SESSION['staff_username']=='staff_username')
					{
						print "<script>";
						print "window.alert('Welcome user'); self.location='user.php';"; 
						print "</script>";						
					}
					else
					{
					echo "<script languange = 'Javascript'>
					alert('Please check again!!');
					location.href = 'login.php';</script>";			
					}
				}
			}			
		}
						

?>

the outcome will always be "please check again!" eventhough the username and password is correct.

why? :(

[Exequiel]

It did not work because the $_SESSION['staff_username '] is empty, you did not set a value for that session.
put this code first

$_SESSION['staff_username']='staff_username';

before your

 if ($_SESSION['staff_username']=='staff_username')

and also for admin.
try it.

[leesyaa]

thanks! it work well :D

but now it doesnt respond to the

<?php 
session_start();
if(!isset($_SESSION['admin_username'])) {
	header("Location: error.php");
	}

?>

that i set to secure the page.

the user could still open the admin page :(

[Exequiel]

Try this code, in this logic we need to check if the session is empty or not, if the session is not empty redirect for admin/staff page, if the session is empty redirect to login page.

<?php
session_start();
ob_start();
include 'coonnectionToDB.php';//your connection to your database

if(!empty($_SESSION['admin_username']))
{
 header("Location: adminpage.php");
}
else if(!empty($_SESSION['staff_username']))
{
 header("Location: staffpage.php");
}
else
{
 header("Location: login.php");
}
?>

[Rabbit]

You never check to see if they are an admin before showing the admin page. You merely set a variable do it's always true.

[Exequiel]

leesyaa's database design is not ok for me, she can make only 1 table for an account for admin and staff and determine what user type the user is.