Php access levels? o.o

[ScHmIdTy56789]

Hello,

So im making myself a login system for my site. and im having trouble with access_levels/permissions.

So this is what i have in my database so far (including my password):


Now when I get the row this is what I use:

Code:

$q = mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = '".md5($_POST['password'])."'"); if(mysql_num_rows($q) > 0) { $alvl = mysql_fetch_row($q); $alvl = $alvl[0]; }

And this is where I use my permissions:

Code:

<? If($alvl >= 4 ) { ?> <div class="musicstub"> Music <br> </div> <script> $(document).ready(function() { $('.musicstub').stop().toggle(function(){ $(this).animate({width: 250, height: 50}, "fast"); },function() { $(this).animate({width: 100, height: 15}, "fast"); }); }); </script> <?}?>

But when I use it, It does not show the music tab. If i do:

Code:

If($alvl = 5 ) { //code here }

It shows the tab for everyone. Is there anything that is wrong with my code? or am i using the database wrong?

Thanks,
ScHmIdTy56789

[Nukem]

Your code is very flawed (can be easily exploited) Didn't see full code.

Last time I checked PHP didn't work that way but you could try this:

Code:

<? If($alvl >= 4 ) { echo '<div class="musicstub"> Music <br>'; echo '</div>'; echo '<script>'; echo '$(document).ready(function() {'; echo ' $('.musicstub').stop().toggle(function(){'; echo ' $(this).animate({width: 250, height: 50}, "fast");'; echo ' },function() {'; echo ' $(this).animate({width: 100, height: 15}, "fast");'; echo ' });'; echo '});'; echo '</script>'; } ?>

I'm no PHP expert and there's probably a better/easier solution

[ScHmIdTy56789]

Your code is very flawed (can be easily exploited)

Last time I checked PHP didn't work that way but you could try this:

Code:

<? If($alvl >= 4 ) { echo '<div class="musicstub"> Music <br>'; echo '</div>'; echo '<script>'; echo '$(document).ready(function() {'; echo ' $('.musicstub').stop().toggle(function(){'; echo ' $(this).animate({width: 250, height: 50}, "fast");'; echo ' },function() {'; echo ' $(this).animate({width: 100, height: 15}, "fast");'; echo ' });'; echo '});'; echo '</script>'; } ?>

I'm no PHP expert and there's probably a better/easier solution

That did not work either

It doesnt show it, which is good. but when I login it doesnt show it at all

Could I be calling it in the wrong spot?

Because this:

Code:

$q = mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = '".md5($_POST['password'])."'"); if(mysql_num_rows($q) > 0) { $alvl = mysql_fetch_row($q); $alvl = $alvl[0]; }

Is in a different spot than this:

Code:

if(!count($err)) { // If there are no errors $_POST['email'] = mysql_real_escape_string($_POST['email']); $_POST['username'] = mysql_real_escape_string($_POST['username']); $pass = $_POST['password']; // Escape the input data mysql_query(" INSERT IGNORE INTO members(usr,pass,email,regIP,dt) VALUES( '".$_POST['username']."', '".md5($pass)."', '".$_POST['email']."', '".$_SERVER['REMOTE_ADDR']."', NOW() )"); }

[JariZ]

It would probably be better to do

Code:

$alv1 = mysql_result(mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = 'md5({$_POST['password']})'"),0);

---

It would also be a good idea to debug it, so throw around some

Code:

var_dump($alv1);

[surtek]

Code:

If($alvl = 5 )

is always true, it just creates the string and set it to 5. This will give the code for everyone, even when $alvl = 200. I think you meant doing this:

Code:

If($alvl == 5 )

notice the == (equals) and not = (create). There is a big difference in php with that. This will only run the code when $alvl is actually 5.

[JariZ]

Ah fuck, you're right, can't believe I missed that.
Listen to what @surtek says