title: PHP & MySQL User login and permissions system
body: <p>I have a user login system for a website set up with PHP and MySQL. My question was whether or not I could modify what I have now, to create a "permissions" system. In other words, only display certain controls for users and different ones for administrators. In my mysql table I have columns <code>'id'</code>, <code>'username'</code>, <code>'password'</code>, and an ENUM 'permissions' with 'a','b'. 'a' is default (not admin). Below I will show you what I have tried.</p>
  
  <p>This file is "<code>checklogin.php</code>" (for the sake of saving space I will not add all of the code)</p>
  
  <pre><code>//First I include variables to connect to the database &amp; connect
  //Then I define username and password as $_POST from a form on an earlier page
  $user=a;
  $admin=b;
  $sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword' and permissions='$user'";
  $sqladmin="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword' and permissions='$admin'";
  $result=mysql_query($sql);
  $resultadmin=mysql_query($sqladmin);
  
  $count=mysql_num_rows($result);
  $countadmin=mysql_num_rows($resultadmin);
  
  // If result matched $myusername and $mypassword, table row must be 1 row
  if($count==1){
   // Register $myusername, $mypassword and redirect to file "login_success.php"
   session_register("myusername");
   session_register("mypassword"); 
   session_register("user"); 
   header("location:login_success.php");
  }
  else {
    if($countadmin==1){
     session_register("myusername");
     session_register("mypassword"); 
     session_register("admin"); 
     header("location:login_success.php");
    }
    else {
      if($count==0) {
        if($countadmin==0) {
         echo "Wrong Username or Password";
        }
      }
    }
  }
  </code></pre>
  
  <p>So in this file I am checking how many rows of the table match the user input and whether or not it is admin, and if there is one, then I register a session with username, password, and permissions.</p>
  
  <p>Next, I have the file "<code>login_success.php</code>"</p>
  
  <pre><code>&lt;?php
  session_start();
  if(!session_is_registered(myusername)){
   header("location:main_login.php");
  }
  else {
  }
  ?&gt;
  &lt;html&gt;
  &lt;body&gt;
  Login Successful
  
  &lt;?php
  if(session_is_registered(admin)){
  echo "Welcome Admin!";
  }
  else {
  echo "Not admin...";
  }
  ?&gt;
  </code></pre>
  
  <p>
     </p>
  
  <p>The code above simply checks if the session is registered and if not, sends you back to the login form. Below that is a section of code that checks if the user is an admin. 
  The login part of this works I just can't work out the permissions. </p>
  
  <p>So finally, I guess my question is why does this not work? It seems logically correct. Sorry for the lengthy post. Thanks for any help.</p>