crud_based_php_admin_role/server.php at master · dsaam94/crud_based_php_admin_role · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
<?php

    session_start();
    $rolid = "";
    $username = "";
    $email    = "";
    $errors = array();
    $_SESSION['success'] = "";


    //connect to db
    $db = mysqli_connect('localhost', 'root', '', 'project1');

    //if register button is clicked
    if (isset($_POST['register'])) {
         $username = mysqli_real_escape_string($db, $_POST['username']);
	     $email = mysqli_real_escape_string($db, $_POST['email']);
	     $password_1 = mysqli_real_escape_string($db, $_POST['password_1']);
	     $password_2 = mysqli_real_escape_string($db, $_POST['password_2']);
         $role = mysqli_real_escape_string($db, $_POST['role']);

         // form validation: ensure that the form is correctly filled
	if (empty($username)) { array_push($errors, "Username is required"); }
	if (empty($email)) { array_push($errors, "Email is required"); }
	if (empty($password_1)) { array_push($errors, "Password is required"); }
    if (empty($role)) {array_push($errors, "Select your role");}

        if($role == "Administrator"){
            $roleid = 1;
        }elseif($role == "Student"){
            $roleid = 2;
        }
        else{
            $roleid = 3;
        }

        if ($password_1 != $password_2) {
		array_push($errors, "The two passwords do not match");
	}

	// register user if there are no errors in the form
	if (count($errors) == 0) {
		$password = md5($password_1);//encrypt the password before saving in the database
		$query = "INSERT INTO users (username, password, email, role_id)
				  VALUES('$username', '$password', '$email', '$roleid')";
		mysqli_query($db, $query);

		$_SESSION['username'] = $username;
		$_SESSION['success'] = "You are now logged in";
		header('location: index.php');
//        if ($row['role']=="1")
//			{
//
//                               header ("location: customer_page.php");
//
//			}
//			else if ($row['role']=="2")
//			{
//                               $_SESSION['role_id']=$row['role_id'];
//
//                               header ("location: manager_page.php");
//
//
//			}
//				//header('location: index.php');
//                else if ($row['role']=="3")
//			{
//                               $_SESSION['role_id']=$row['role_id'];
//
//                               header ("location: admin_page.php");
//
//
//			}
//
	}

}
    // LOGIN USER
	if (isset($_POST['login_user'])) {
		$username = mysqli_real_escape_string($db, $_POST['username']);
		$password = mysqli_real_escape_string($db, $_POST['password']);

		if (empty($username)) {
			array_push($errors, "Username is required");
		}
		if (empty($password)) {
			array_push($errors, "Password is required");
		}

		if (count($errors) == 0) {
			$password = md5($password);
			$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
			$results = mysqli_query($db, $query);
            $row=mysqli_fetch_array($results);
            $_SESSION['user_id']=$row['user_id'];
            $_SESSION['role_id']=$row['role_id'];

			if (mysqli_num_rows($results) == 1){
                $_SESSION['user_name'] = $username;
				$_SESSION['success'] = "You are now logged in";
                if ($row['role_id']=="1")
			{

                               header ("location: index.php");

			}
			else if ($row['role_id']=="2")
			{
                               $_SESSION['role_id']=$row['role_id'];

                               header ("location: manager_page.php");


			}
				//header('location: index.php');
                else if ($row['role_id']=="3")
			{
                               $_SESSION['role_id']=$row['role_id'];

                               header ("location: admin_page.php");


			}

			}

            else {
				array_push($errors, "Wrong username/password combination");
			}
		}
	}


       if (isset($_GET['logout']))  {

       	  session_destroy();
       	  unset($_SESSION['username']);
       	  header('location: login.php');
       }


 ?>