I have a form with only a username that will allow for access to two pages depending an users authority level in an MS SQL database.
If their authority level is 10 then they will log into the 'normal' page, however anything more and they will be logged into an admin page with more functionality. This all works fine, however It's letting anything typed into the username to log in.
I'm struggling to prevent it logging in any username that isn't in the database. This is what I have so far...
$conn = odbc_connect(database connection stuff here);
$login = $_POST['login'];
$sqlquery = "SELECT u.authorityLevel, u.employeeNo, e.knownAs FROM common.dbo.users as u JOIN
common.dbo.employees AS e on e.employeeNo = u.employeeNo WHERE u.employeeNo = '".$login."'";
$result = odbc_exec($conn, $sqlquery);
$user = odbc_fetch_array($result);
$userExists = odbc_num_rows($sqlquery);
if((isset($_SESSION['login']['logged_in']) && $_SESSION['login']
['logged_in'])==true){
if(isset($_POST)){
if ((int)$user['authorityLevel'] > 10) {
header("location: indexAdmin.php");
$row = $user;
$_SESSION['sessionUserName'] = $row['knownAs'];
} elseif ((int)$user['authorityLevel'] = 10) {
header("location: confirmedJobs.php");
$row = $user;
$_SESSION['sessionUserName'] = $row['knownAs'];
} else ((int)$user['authorityLevel'] < 10){
header("location: loginPage.php");
}
}
}
$userExists = odbc_num_rows($sqlquery);
you're just declaring the variable for it.lulz'; DROP TABLE common.dbo.users; --
might come by at some point.$login
properly in your query