Permissions help

[9antsim]

I am trying to sort out permissions for when the user logins in so if there friend or family they will switch to a different userpanel but i have tried this:

 

<?php
$conn = mysql_connect('BLANK', 'BLANK', 'BLANK') or die(mysql_error());
mysql_select_db('BLANK', $conn);
// Start session
session_start(); 

// Check if user is logged in
if(isset($_SESSION['user_id'])) {
// User is logged in!
$query = mysql_query("SELECT username FROM login
			   WHERE ID = " . $_SESSION['user_id'] )
			   or die(mysql_error());

list($username) = mysql_fetch_row($query);

echo 'Hi '. $username . ', welcome to your profile!';

} else {

// User not logged in
echo 'Please login before opening the user panel.';

}

// This allows me to change the content the person will see
if($_SESSION['rank'] == "friend")
{
echo include "friendpanel.php";
}
if($_SESSION['rank'] == "admin")
{
echo include "admincontrol.php";
}
?>

 

Can anyone see whats wrong with it?

[hansford]

I dont see where $_SESSION['rank'] is getting set

[9antsim]

I have tried using this but then it just comes up with a blank screen.

 

$query = mysql_query("SELECT rank FROM login
			WHERE RANK = " . $_SESSION['rank_level']
			or die(mysql_error());

[hansford]

you have a session started. somewhere

$_SESSION['rank'] needs to be set from some form input or from a check of the database to see their relationship to the user.

 

 

[9antsim]

does the query i type not grab the user information (sorry if this sounds stupid this is my first script)

[hansford]

it grabs the $username and thats all. the problem is here. There is no $_SESSION['rank'] so none of that code is ever executed. Maybe in your DB you can store the username along with who that person is ie: admin,friend

then you grab that value and store it in a variable such as $who then we can do:

 

if($who == "friend")

{

echo include "friendpanel.php";

}

if($who == "admin")

{

echo include "admincontrol.php";

}

[9antsim]

I made a field in my DB called rank so the person could automacially decide if they want them to have certain rights,

 

i added a session of the rank above the two options which it would bring up the correct usercontrol for them, but i haven't define what $_SESSION = [rank] is so all it knows is that [rank] equals a session. I hope that actually made sense? I have stripped all the rank out and going to start again to add it in so i don't mess up my login script so far