title: Restrict access to pages using sessions
body: <p>I have used a login system on my website using sessions.</p>
  
  <p>This is how it looks,</p>
  
  <pre><code>&lt;?php
  session_start();
  
  ob_start();
  
  include 'includes/db.php';
  
  $idadm=$_POST['idadm'];
  $passadm=$_POST['passadm'];
  
  $idadm = stripslashes($idadm);
  $passadm = stripslashes($passadm);
  $idadm = mysql_real_escape_string($idadm);
  $passadm = mysql_real_escape_string($passadm);
  
  $sql="SELECT * FROM admin WHERE aid='$idadm' and password='$passadm'";
  $result = $conn-&gt;query($sql);
  
  $count = $result-&gt;num_rows;
  
  if($count == 1) {
      $_SESSION['idadm'] = $idadm;
      $_SESSION['passadm'] = $passadm;
  
  if ($_SESSION['idadm'] == 'admin') {
      header("location:admin/index.php");
  } else {
      header("location:subadmin/index.php");
  }
  } else {
      header("location:index.php");
  }
  
  ob_end_flush();
  ?&gt;
  </code></pre>
  
  <p>db.php has the database credentials.</p>
  
  <p>This is the code that is on top of the protected pages,</p>
  
  <pre><code>&lt;?php
      session_start();
      if (!isset($_SESSION['idadm'])) {
          header('location:/index.php');
          die;
  }
  ?&gt;
  </code></pre>
  
  <p>The login script works fine except for one problem, logged in users can access both admin and subadmin pages.</p>
  
  <p>There is only one admin user and the ID for that user in the database is 'admin'. Admin should be able to access only 'admin/index.php' and other users should be able to access 'subadmin/index.php'.</p>
  
  <p>How do I modify the script to make this happen?</p>