Question

I have this code, it is successfully storing the ‘author_id’ but I want it to store the ‘author_is_admin’ field too. What am I doing wrong. I am new to PHP, so explaining what the code you write is doing might help.

<?php
session_start();
require_once('inc/config.php');

$_SESSION['author_is_admin'];

    if (isset($_SESSION['author_id'])) {    // Logged in.
/* Build redirect URL */
$url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
if (!(substr($url, -1) == '/')) {
    $url .= '/';
}

/* Redirect to index. */
header("Location: $url");
exit();
}

$error = false;

if (isset($_POST['submitted'])) {   // Form submitted, attempt login.
if (!empty($_POST['email']) && !empty($_POST['password'])) {    // Email & password      entered.
    require_once('inc/db.php');
    $email = escape_data($_POST['email']);
    $password = escape_data($_POST['password']);
} else {    // Email or password empty.
    $email = $password = false;
    $error = true;
}
if ($email && $password) {  // Email and password entered.
    $query = "SELECT author_id FROM authors WHERE (author_email ='$email' AND author_password = MD5('$password'))";
    $result = mysql_query($query) or trigger_error('Error: ' . mysql_error());

    if (@mysql_num_rows($result) == 1) {    // Email and password correct.
        $row = mysql_fetch_array($result);
        mysql_free_result($result);
        mysql_close();

        /* Store session data */
        $_SESSION['author_id'] = $row['author_id'];
        $_SESSION['author_is_admin'] = $row['author_is_admin'];

        /* Build redirect URL */
        $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
        if (!(substr($url, -1) == '/')) {
            $url .= '/';
        }

        /* Redirect to index */
        header("Location: $url");
        exit();
    } else {    // User not authenticated.
        $error = true;
    }
} else {    // Email and/or password not entered.
    $error = true;
}
  }

  ?>

Answer 1

You aren’t retrieving that column in your query:

$query = "SELECT author_id FROM authors WHERE (author_email ='$email' AND author_password....."

//Should be 
$query = "SELECT author_id, author_is_admin FROM authors WHERE (author_email ='$email' AND author_password"