Question

I want to validate whether a user is logged in and if the user is authorized to view content using php.

if($_SESSION['log'] != "1"){
if($_SESSION['type'] != "1" || $_SESSION['type'] != "2" || $_SESSION['type'] != "3"){
    header("Location: redirect.php");
}}

This works perfectly.

But I want to check all in the same statement as below. But it is not working even for a correct login.

if($_SESSION['log'] != "1" || $_SESSION['type'] != "1" || $_SESSION['type'] != "2" || $_SESSION['type'] != "3"){
    header("Location: redirect.php");
}

Answer 1

The logic from your first set of code would indicate a slightly different if statement:

if($_SESSION['log'] != "1" && ($_SESSION['type'] != "1" || $_SESSION['type'] != "2" || $_SESSION['type'] != "3")){
    header("Location: redirect.php");
}

In your original working code, you only test the type session info if log != 1 which means your second code may well be executing on ANY of the other clauses that would not be checked at all in the original.

Edit Your original code:

if($_SESSION['log'] != "1")
{
// This condition is ALWAYS checked.
    if($_SESSION['type'] != "1" || $_SESSION['type'] != "2" || $_SESSION['type'] != "3")
    {
    // These conditions are ONLY checked if the first check passes.
        header("Location: redirect.php");
    }
}

In your second example, all the conditions were being checked at the same time, and as you used an OR operator, if ANY of them passed, ir would evaluate to true.