Php access levels? o.o

[ScHmIdTy56789]

Hello,

So im making myself a login system for my site. and im having trouble with access_levels/permissions.

So this is what i have in my database so far (including my password):


Now when I get the row this is what I use:

Code:

$q = mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = '".md5($_POST['password'])."'");
if(mysql_num_rows($q) > 0)
{
    $alvl = mysql_fetch_row($q);
    $alvl = $alvl[0];
}

And this is where I use my permissions:

Code:

<? If($alvl >= 4 ) { ?>


    <div class="musicstub"> Music <br>
        </div>
<script>
$(document).ready(function() {
    $('.musicstub').stop().toggle(function(){
        $(this).animate({width: 250, height: 50}, "fast");
    },function() {
        $(this).animate({width: 100, height: 15}, "fast");
    });
});
</script>
<?}?>

But when I use it, It does not show the music tab. If i do:

Code:

If($alvl = 5 )
{
//code here
}

It shows the tab for everyone. Is there anything that is wrong with my code? or am i using the database wrong?

Thanks,
ScHmIdTy56789

[Nukem]

Your code is very flawed (can be easily exploited) Didn't see full code.

Last time I checked PHP didn't work that way but you could try this:

PHP Code

<?
If($alvl >= 4 )
{
	echo '<div class="musicstub"> Music ';
	echo '</div>';
	echo '<script>';
 
	echo '$(document).ready(function() {';
	echo '    $('.musicstub').stop().toggle(function(){';
	echo '        $(this).animate({width: 250, height: 50}, "fast");';
	echo '    },function() {';
	echo '        $(this).animate({width: 100, height: 15}, "fast");';
	echo '    });';
	echo '});';
	echo '</script>';
}
?>

I'm no PHP expert and there's probably a better/easier solution

[ScHmIdTy56789]

Your code is very flawed (can be easily exploited)

Last time I checked PHP didn't work that way but you could try this:

PHP Code

<?
If($alvl >= 4 )
{
	echo '<div class="musicstub"> Music ';
	echo '</div>';
	echo '<script>';
 
	echo '$(document).ready(function() {';
	echo '    $('.musicstub').stop().toggle(function(){';
	echo '        $(this).animate({width: 250, height: 50}, "fast");';
	echo '    },function() {';
	echo '        $(this).animate({width: 100, height: 15}, "fast");';
	echo '    });';
	echo '});';
	echo '</script>';
}
?>

I'm no PHP expert and there's probably a better/easier solution

That did not work either

It doesnt show it, which is good. but when I login it doesnt show it at all

Could I be calling it in the wrong spot?

Because this:

PHP Code

$q = mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = '".md5($_POST['password'])."'");
if(mysql_num_rows($q) > 0) 
{
	$alvl = mysql_fetch_row($q);
	$alvl = $alvl[0];
}

Is in a different spot than this:

PHP Code

if(!count($err))
	{
		// If there are no errors
 
		$_POST['email'] = mysql_real_escape_string($_POST['email']);
		$_POST['username'] = mysql_real_escape_string($_POST['username']);
		$pass = $_POST['password'];
		// Escape the input data
 
 
		mysql_query("	INSERT IGNORE INTO members(usr,pass,email,regIP,dt)
						VALUES(
 
							'".$_POST['username']."',
							'".md5($pass)."',
							'".$_POST['email']."',
							'".$_SERVER['REMOTE_ADDR']."',
							NOW()
 
						)");
 
 
	}

[JariZ]

It would probably be better to do

PHP Code

$alv1 = mysql_result(mysql_query("SELECT access_level FROM members WHERE usr = '$username' AND pass = 'md5({$_POST['password']})'"),0);

---

It would also be a good idea to debug it, so throw around some

PHP Code

var_dump($alv1);

[surtek]

Code:

If($alvl = 5 )

is always true, it just creates the string and set it to 5. This will give the code for everyone, even when $alvl = 200. I think you meant doing this:

Code:

If($alvl == 5 )

notice the == (equals) and not = (create). There is a big difference in php with that. This will only run the code when $alvl is actually 5.

[JariZ]

Ah fuck, you're right, can't believe I missed that.
Listen to what @surtek says