Question

What is the problem with following code? Please help me out.

I want to match admin-id and password from the database along with login-id and password of the normal users and further want to transfer the control to the respective forms.

When I run this code it gives following errors:

Notice: Undefined variable: userstatus in C:\xampp\htdocs\xampp\Test\HRMS\extract.php on line 25

Notice: Undefined variable: usertype in C:\xampp\htdocs\xampp\Test\HRMS\extract.php on line 30

$query1="select user_type,user_staus from `user_info` where name='$username' and  
password='$password'";
$fetched=mysql_query($query1);

while($record=mysql_fetch_assoc($fetched))
{
    while(each($record))
    { 
        $usertype=$record["user_type"];
        $userstatus=$record["user_staus"];
    }//closing of 1st while loop
}//closing of 2nd while loop

if($userstatus==1) //if is logged in already
{
    echo "Please login after some time";
    exit();
}

if($usertype == 0) // if user is not an admin
{
    $query1="select * from `user_info` where name='$username' and  password='$password'";
    $result = mysql_query($query1);
    if(mysql_num_rows($result) == 1) 
    {
        header("Location: user_form.php");
    }
}
else if($usertype == 1) //if the user is a normal user
{
    header("Location: admin_form.php");
}
else 
{
    echo "please register to login";
}   

Can someone help me find the problem?

Answer 1

There are many problems with your code, main reason you receiving an error is because $usertype and $userstatus are not predefined and not validated.
But in my opinion it is not a main issue with your code.

There are few questions that I would like to ask you:

• Why creating two loops if you need to fetch a single row?
• Why querying database twice if you already know the answer?
• Are you escaping $username and $password for bad characters using mysql_real_escape_string method?

here is an example how this code should look like:

$query1 = "SELECT user_type,user_staus FROM `user_info` WHERE name='{$username}' AND password='{$password}' LIMIT 1";

$fetched = mysql_query($query1);

//check if record exists otherwise you would receive another notice that can 
//break redirect functionality
if (mysql_num_rows($fetched))
{
    $record = mysql_fetch_assoc($fetched);

    // make sure that value is integer
    if ((int)$record["user_staus"])
    {
        exit("Please login after some time");
    }
    else
    {
        $url = (bool)$record["user_type"] ? 'admin_form.php' : 'user_form.php';

        header("Location: {$url}");

        exit(0);
    }

}
else
{
    echo "please register to login";
}

UPDATE
As suggested by nikc.org, removed 3rd level if nesting and replaced with ternary comparison