php - How to set session for a specific user -

i trying set session specific user database (admin) idea if admin logged in redirect admin page . , have more privileges.

session_start(); require 'funcs.php';  $error = false;  if (! empty($_post)) {     $username = $_post['username'];     $password = md5($_post['password']);     $sql = "select * `users`             `username` = '$username' ,             `password` = '$password' limit 1";          $result = query($sql,true);     if(! empty($result)) {         $_session['name'] = $result[0]['fullname'];         $_session['user'] = $result[0]['username'];         header("location: index.php");         die;     } else {         $error = true;     } 

i'd start adding new column table i.e. user_level flag determine user admin , user not. can assign flag session value:

$_session['userlevel'] = $result[0]['user_level']; 

then can if/else checks value...

edit: table structure should like:

id, username, password, user_level = (normal|admin) 

the user_level value should either normal user or admin user, , default when set it. should normal user unless if want user admin set column "admin".

now going code:

session_start(); require 'funcs.php';  $error = false;  if (! empty($_post)) {     $username = $_post['username'];     $password = md5($_post['password']);     $sql = "select * `users`             `username` = '$username' ,             `password` = '$password' limit 1";      $result = query($sql,true);     if(! empty($result)) {         $_session['name'] = $result[0]['fullname'];         $_session['user'] = $result[0]['username'];         $_session['userlevel'] = $result[0]['user_level'];          if( $_session['userlevel'] === 'admin')         {            //go admin page            header("location: admin.php");         }         else         {            header("location: index.php");         }         exit;     } else {         $error = true;     } 

now in admin page need check if user admin doing routine in of admin pages:

if(!isset($_session['userlevel']) || $_session['userlevel'] !== 'admin') //you can add more checks {    //redirect login page    header("location: login.php"); } 

something that...