Question

I am creating few pages (including login page) which should only be accessible by a sysadmin.

In login.php after the user’s credentials have been verified. I set a session variable like so:

mysql_connect("localhost", $values['uname'], $values['password']) or 
die(mysql_error());
echo "Connected to MySQL<br />";
mysql_select_db("somedb") or die (mysql_error());

session_start();
$_SESSION['level'] = 'admin';
header('Location: /admin/index.php'); 

And then in the index.php page I am doing the following:

<?php 
if($_SESSION['level'] !== 'admin'){
    header("location:../admin/login.php");
}
?>

But it does not seem to work. Everytime I am being redirected to login.php (even after successfully logging in via login.php).
Is there something wrong with this approach and how I am going about this?

Basically on page other than login.php I need a way to make sure user is logged in…

Answer 1

You needed to initialize Sessions in every pages you wanted to work with Sessions. Put session_start() at the top of the page (before sending the header).