Click here to Skip to main content
15,885,172 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have a html navbar code and I need to convert it to php when logging in a user shows him custom navebar and when the administrator logs in, he sees his own page




for admin



<div class="navbar">
<a href="index.html">home</a>
<a href="about.html">about us</a>
<a href="brand.html">brand</a>
<a href="portfilo.html">porfile</a>
<a href="admin_page.php">control panel</a>
<div class="navbar-right">
<a href="signup.php">Sign Up</a>
<a href="login.php">Login</a>
</div>
</div> 



for user

<div class="navbar">
<a href="index.html">home</a>
<a href="about.html">about us</a>
<a href="brand.html">brand</a>
<a href="portfilo.html">porfile</a>
<a href="user_page.php">user page</a>
<div class="navbar-right">
<a href="signup.php">Sign Up</a>
<a href="login.php">Login</a>
</div>
</div> 


What I have tried:

I tried a lot with php but I'm not a pro at it

I use this code to log in

<?php

@include 'config.php';

session_start();

if(isset($_POST['submit'])){

   $name = mysqli_real_escape_string($conn, $_POST['name']);
   $email = mysqli_real_escape_string($conn, $_POST['email']);
   $pass = md5($_POST['password']);
   $cpass = md5($_POST['cpassword']);
   $user_type = $_POST['user_type'];

   $select = " SELECT * FROM user_form WHERE email = '$email' && password = '$pass' ";

   $result = mysqli_query($conn, $select);

   if(mysqli_num_rows($result) > 0){

      $row = mysqli_fetch_array($result);

      if($row['user_type'] == 'admin'){

         $_SESSION['admin_name'] = $row['name'];
         header('location:admin_page.php');

      }elseif($row['user_type'] == 'user'){

         $_SESSION['user_name'] = $row['name'];
         header('location:user_page.php');

      }
     
   }else{
      $error[] = 'incorrect email or password!';
   }

};
?>
Posted
Updated 9-May-22 8:42am
v2
Comments
Richard Deeming 10-May-22 3:58am    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation/interpolation to build a SQL query. ALWAYS use a parameterized query.
PHP: SQL Injection - Manual[^]
PHP: Prepared statements and stored procedures - Manual[^]
Richard Deeming 10-May-22 3:59am    
You are storing your users' passwords as an unsalted MD5 hash. MD5 has not been considered "secure" for at least twenty years.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

PHP provides built-in functions to help you do the right thing. Use them.

PHP: password_hash[^]
PHP: password_verify[^]

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900