php - 多级登录不进入指定菜单

Question

我想做多级用户登录菜单，但它不会根据不同的用户级别进入分配的菜单。我做错了什么？`

	# LOGIN CEK TO USER TABLE LOGIN
		$loginSql = "SELECT * FROM user WHERE username='$txtUser' AND password='".md5($txtPassword)."'";
		$loginQry = mysql_query($loginSql, $koneksidb) or die ("Query Salah : ".mysql_error());

		# IF SUCCEED
		if (mysql_num_rows($loginQry) >=1) 
		{
			$loginData = mysql_fetch_array($loginQry);
			$_SESSION['SES_LOGIN'] 	= $loginData['kode_user']; 
			$_SESSION['SES_ADMIN'] 	= $txtUser;
			$_SESSION['level']      = $loginData['level'];
			// Refresh
			if($row['level'] == "admin")
        {
            
            header("Location: admin.php");
        }
        else if($row['level'] =="academic")
        {
            header("Location: academic.php");
        }
        else if($row['level'] == "student")
        {
            
            header("Location: student.php");
        }
			echo "<meta http-equiv='refresh' content='0; url=?open'>";
		}

`

Answer 1

您从未设置$row，而是设置了$loginData，因此

if($row['level'] == "admin")...
else if($row['level'] =="academic")...
else if($row['level'] =="student")...

不会工作。您应该使用此测试:

if($loginData['level'] == "admin")...
else if($loginData['level'] =="academic")...
else if($loginData['level'] =="student")...

或使用 session 变量(确保 session_start() 位于脚本顶部):

if($_SESSION['level'] == "admin")...
else if($_SESSION['level'] =="academic")...
else if($_SESSION['level'] =="student")...

警告!

Little Bobby说your script is at risk for SQL Injection Attacks. 。偶escaping the string不安全!

请stop using mysql_* functions . These extensions已在 PHP 7 中删除。了解 prepared PDO 的声明和 MySQLi并考虑使用 PDO，it's really pretty easy .

你真的不应该使用 MD5 password hashes 你真的应该使用 PHP 的 built-in functions来处理密码安全。确保您don't escape passwords或在散列之前对它们使用任何其他清理机制。这样做会更改密码并导致不必要的额外编码。