管理員只訪問php

Question

我試圖編寫一個頁面，只允許用戶具有管理員權限（作爲管理員對數據庫中的角色記錄）。如果他們是管理員，則從數據庫中提取照片以供審批。如果不是管理員，那麼他們會被重定向到管理頁面並且看不到圖像。

在登錄時可以查看頁面並顯示圖像。我究竟做錯了什麼？

感謝

<?php 

session_start(); 



$isLoggedIn = isset($_SESSION['first_name']) && isset($_SESSION['username']); 
$username = $_SESSION['username']; 

if ($isLoggedIn && $_SESSION['username']){ 


echo "Welcome ".$_SESSION['first_name']."<br><a href='login/logged_out.php'>log  
out</a>"; 

} 


$username = $_SESSION['username']; 
//var_dump($username); 

include("..\connection\connection.php"); 


// Connect to server and select database. 

mysql_connect($host, $username, $password)or die("cannot connect"); 

mysql_select_db($db_name) or die("cannot select DB"); 

$query=mysql_query("SELECT * FROM users WHERE username = '$username' AND role = 
'admin'"); 

echo(mysql_error()); 

$num_rows = mysql_num_rows($query); 


if ($num_rows =1){     

include("..\connection\connection.php"); 

// Connect to server and select databse. 
mysql_connect($host, $username, $password)or die("cannot connect"); 
mysql_select_db($db_name) or die("cannot select DB"); 


$photo=mysql_query("SELECT * FROM images WHERE approved='N'"); 

echo(mysql_error()); 

$numrows = mysql_num_rows($photo);//counts the number or rows returned from database 
matching the mysql_query. 

if ($numrows==0){ 

echo "There are no images awaiting approval."; 
} 


while($get_photo=mysql_fetch_array($photo)){?> 

<a href="approve_image_submit.php?images=<?php echo $get_photo['big_images']; ?>" 
target=""><img src="<? echo $get_photo['url']; ?>" title=""> 


<? } ?> 
<? 
}else{ 


die ("You do not have permission to view this page. Redirect to index.phph Click <a 
href='login/login_page.php'>here</a> to log in."); 
       // 


} 
?> 

Answer 1

if ($num_rows =1){ 

應該

if ($num_rows==1){ 

Answer 2

，可能的事情是不對您的腳本

A. username與database用戶名 B.所以$_SESSION varriables是衝突設置 C.無效logic

我可以繼續下去

我有幫助重寫代碼，但你需要提供相關信息，以取代

session_start(); 
include ("..\connection\connection.php"); 

$username = @$_SESSION ['username']; 
$rowPhoto = array(); 
$dbHost = ""; 
$dbUser = ""; 
$dbPass = ""; 
$dbName = ""; 

if ($_SESSION ['AUTH'] == true && ! isset ($_SESSION ['username'])) { 
    echo "Welcome " . $_SESSION ['first_name'] . "<br><a href='login/logged_out.php'>log out</a>"; 
    exit(); 
} 
$mysqli = new mysqli ($dbHost, $dbUser, $dbPass, $dbName); // Replace with relevant information 
$result = $mysqli->query ("SELECT * FROM users WHERE username = '$username' AND role = 'admin'"); 

if ($result->num_rows == 1) { 
    $userInfo = $result->fetch_assoc(); 
    $photoResult = $mysqli->query ("SELECT * FROM images WHERE approved='N'"); 
    $_SESSION ['AUTH'] = true; 
    $_SESSION ['first_name'] = $userInfo ['first_name']; // Replace With 
    $_SESSION ['username'] = $username ; 
                 // Information 
    if ($photoResult->num_rows == 0) { 
     echo "There are no images awaiting approval."; 
    } else { 
     $rowPhoto = ""; 
     while ($rowPhoto = $photoResult->fetch_assoc()) { 
      echo "<a href=\"approve_image_submit.php?images={$rowPhoto['big_images']}\" target=\"><img src=\"{$rowPhoto['url']}\" title=\"\">"; 
     } 
    } 

} else { 

    die ("You do not have permission to view this page. Redirect to index.phph Click <a 
      href='login/login_page.php'>here</a> to log in."); 
} 

我希望這有助於

謝謝