Php 是否将用户访问级别添加到流程登录？

我是否可以通过此流程代码添加用户访问级别？我有我的注册码，这将允许普通用户注册。我将只通过PHPMyAdmin设置管理员。如何使用此流程页面定义管理员用户访问级别

代码：login_process.php

示例代码：

---

当然，这取决于您在数据库中存储数据的方式，但是如果您的用户表有以下列：user\u name、password、user\u type

当您在登录功能上检查用户名和密码是否匹配时，您可以执行以下操作：

SELECT user_name, password, user_type FROM users WHERE user_name = '".$email."' AND password = '".$password"'";

然后检查返回的行数，如果返回0，则凭据不匹配，用户不登录。如果它们匹配，那么您可以使用user_级别重定向到您想要的位置

如果你可以发布你的登录功能，我可以解释你在代码中所做的更改

编辑：在发布登录功能后添加固定功能

登录验证：

    include_once 'includes/db_connect.php';
    include_once 'includes/functions.php';

    sec_session_start(); // Our custom secure way of starting a PHP session.

    if (isset($_POST['email'], $_POST['p'])) {
        $email = $_POST['email'];
        $password = $_POST['p']; // The hashed password.

        if (login($email, $password, $mysqli) == true) {
            // Login success
            //Redirecting to admin protected page for instance
            if( isset($_session['user_type']) and $_session['user_type'] == 'admin' )
                header('Location: ./protected_page.php');
            else {
                //redirect to normal logged user
                header('Location: ./normal_user_logged.php');

            }


        } else {
            // Login failed 
            header('Location: ./index.php?error=1');
        }
    } 

    else {
        // The correct POST variables were not sent to this page. 
        echo 'Invalid Request';
    }
?>

登录功能：

    include_once 'includes/db_connect.php';
    include_once 'includes/functions.php';

    sec_session_start(); // Our custom secure way of starting a PHP session.

    if (isset($_POST['email'], $_POST['p'])) {
        $email = $_POST['email'];
        $password = $_POST['p']; // The hashed password.

        if (login($email, $password, $mysqli) == true) {
            // Login success
            //Redirecting to admin protected page for instance
            if( isset($_session['user_type']) and $_session['user_type'] == 'admin' )
                header('Location: ./protected_page.php');
            else {
                //redirect to normal logged user
                header('Location: ./normal_user_logged.php');

            }


        } else {
            // Login failed 
            header('Location: ./index.php?error=1');
        }
    } 

    else {
        // The correct POST variables were not sent to this page. 
        echo 'Invalid Request';
    }
?>

    function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible. 
    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt, user_type 
        FROM members
       WHERE email = ?
        LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt, $user_type);
        $stmt->fetch();

        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {
            // If the user exists we check if the account is locked
            // from too many login attempts 

            if (checkbrute($user_id, $mysqli) == true) {
                // Account is locked 
                // Send an email to user saying their account is locked
                return false;
            } else {
                // Check if the password in the database matches
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];
                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;
                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                                "", 
                                                                $username);
                    $_SESSION['username'] = $username;
                    $_SESSION['login_string'] = hash('sha512', 
                              $password . $user_browser);
                    // Login successful.
                    $_SESSION['user_type'] = $user_type;
                    return true;
                } else {
                    // Password is not correct
                    // We record this attempt in the database
                    $now = time();
                    $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                    VALUES ('$user_id', '$now')");
                    return false;
                }
            }
        } else {
            // No user exists.
            return false;
        }
    }
}

---

验证登录后，在重定向到受保护的_页面之前，设置一个包含用户级别的会话。phpi添加了示例代码，这样行吗？如果愿意，可以重定向到相同的位置，重要的是在成功登录时将用户级别值存储在会话中。然后，您可以在应用程序中执行任何您想要的操作，因为您可以很容易地判断用户的级别。

    include_once 'includes/db_connect.php';
    include_once 'includes/functions.php';

    sec_session_start(); // Our custom secure way of starting a PHP session.

    if (isset($_POST['email'], $_POST['p'])) {
        $email = $_POST['email'];
        $password = $_POST['p']; // The hashed password.

        if (login($email, $password, $mysqli) == true) {
            // Login success
            //Redirecting to admin protected page for instance
            if( isset($_session['user_type']) and $_session['user_type'] == 'admin' )
                header('Location: ./protected_page.php');
            else {
                //redirect to normal logged user
                header('Location: ./normal_user_logged.php');

            }


        } else {
            // Login failed 
            header('Location: ./index.php?error=1');
        }
    } 

    else {
        // The correct POST variables were not sent to this page. 
        echo 'Invalid Request';
    }
?>

    function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible. 
    if ($stmt = $mysqli->prepare("SELECT id, username, password, salt, user_type 
        FROM members
       WHERE email = ?
        LIMIT 1")) {
        $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
        $stmt->execute();    // Execute the prepared query.
        $stmt->store_result();

        // get variables from result.
        $stmt->bind_result($user_id, $username, $db_password, $salt, $user_type);
        $stmt->fetch();

        // hash the password with the unique salt.
        $password = hash('sha512', $password . $salt);
        if ($stmt->num_rows == 1) {
            // If the user exists we check if the account is locked
            // from too many login attempts 

            if (checkbrute($user_id, $mysqli) == true) {
                // Account is locked 
                // Send an email to user saying their account is locked
                return false;
            } else {
                // Check if the password in the database matches
                // the password the user submitted.
                if ($db_password == $password) {
                    // Password is correct!
                    // Get the user-agent string of the user.
                    $user_browser = $_SERVER['HTTP_USER_AGENT'];
                    // XSS protection as we might print this value
                    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                    $_SESSION['user_id'] = $user_id;
                    // XSS protection as we might print this value
                    $username = preg_replace("/[^a-zA-Z0-9_\-]+/", 
                                                                "", 
                                                                $username);
                    $_SESSION['username'] = $username;
                    $_SESSION['login_string'] = hash('sha512', 
                              $password . $user_browser);
                    // Login successful.
                    $_SESSION['user_type'] = $user_type;
                    return true;
                } else {
                    // Password is not correct
                    // We record this attempt in the database
                    $now = time();
                    $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                    VALUES ('$user_id', '$now')");
                    return false;
                }
            }
        } else {
            // No user exists.
            return false;
        }
    }
}