php - PHP多级登录

Question

我正在尝试开发一个支持多级登录目的的 PHP 系统。我想在我的 PHPMyAdmin 中为不同级别的用户使用枚举。这是登录脚本:

<?php
session_start(); // Starting Session

$error=''; // Variable To Store Error Message
$empty='';
$no_acc='';
if (isset($_POST['submit'])) 
{   
if (empty($_POST['username']) || empty($_POST['password'])) {
$empty = "Username or Password cannot be empty.";

}
else
{
// Define $username and $password
$username=$_POST['username'];
$password=$_POST['password'];
$type='';

// Establishing Connection with Server by passing server_name, user_id and password as a parameter
$connection = mysql_connect("localhost", "root", "");


// Selecting Database
$db = mysql_select_db("swmlibrary", $connection);

// To protect MySQL injection for Security purpose
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);
// SQL query to fetch information of registerd users and finds user match.
$query = mysql_query(" SELECT `id` FROM `users` WHERE `username` = '".$username."' AND  `password` = '".$password."' ");
$rows = mysql_num_rows($query);

$data = mysql_fetch_array($query);
$type = $data['type'];  
$user = $data['username'];      
if ($rows == 1) 
{
$_SESSION['username'] = $data['username'];
    if($type=='Super User')
        {   
             $_SESSION['login_user'] = $username;
             echo "<script>location.assign('./rootSU/super_user.php')     </script> ";

            //header("location: ./rootSU/super_user.php");
        }
    elseif ($type=='Administrator')
        {
            $_SESSION['login_user']=$username; // Initializing Session
            echo "<script>location.assign('./admini/admin.php')</script> ";
            //header("location: ./admini/admin.php");   
        }
    elseif ($type=='User')
        {

            $_SESSION['login_user']=$username; // Initializing Session
            echo "<script>location.assign('./user/home.php')</script> ";

            //header("location: ./user/home.php"); 
        }
    else
    {
        $no_acc = 'It seems as if you do not have an account. Click <a href="sign_form.php">here</a> to sign up.';  
    }

}
else 
{
$error = "Incorrect Username or Password. Please try again.";
}
mysql_close($connection); // Closing Connection
}  
}           

?>

它没有提取用户类型，显示没有帐户的错误，将我重定向到 sign_form.php 页面。我在这里缺少什么？

Answer 1

$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);
$query = mysql_query(" SELECT `id` FROM `users` WHERE `username` = '".$username."' AND  `password` = '".$password."' ");

您没有声明也没有查询您想要的用户类型。