How to use session for different users from different classes? - php

Question

I'm able to successfully create sessions and run them and it works fine in pages exclusive to those particular users.
For example, if there are 8 pages for admin then those 8 pages will contain the code which checks only for the admin session from the admin class.
But if there is a page where all three have the user permission to, which will be the login page I'm unable to handle three sessions together for three separate users. When I am already logged in to the system using any one of the users and then try to go to the login page it should automatically redirect me to that user's exclusive home page. But instead it asks me to enter the login credentials again.
My PHP code:
<?php
if(isset($_SESSION['p_login'])){
header("location:login_tests/Patient.php");
}
else if(isset($_SESSION['d_login'])){
header("location:login_tests/Doctor.php");
}
else if(isset($_SESSION['a_login'])){
header("location:admin/Dashboard.php");
}
// Login functionalities
if(isset($_POST['submit1'])){
// Patient login
if($_POST['users']=="patient"){
session_start();
include_once 'classes/patient.php';
$patient = new Patient();
if ($patient->p_session())
{
header("location:login_tests/Patient.php");
}
$patient = new Patient();
if ($_SERVER["REQUEST_METHOD"] == "POST"){
$login = $patient->p_login($_REQUEST['username'],$_REQUEST['password']);
if($login){
header("location:login_tests/Patient.php");
}
else
{
echo "<script>alert('Login Failed!');</script>";
}
}
}
// Doctor login
else if($_POST['users']=="doctor"){
session_start();
include_once 'classes/doctor.php';
$doctor = new Doctor();
if ($doctor->d_session())
{
header("location:login_tests/Doctor.php");
}
$doctor = new Doctor();
if ($_SERVER["REQUEST_METHOD"] == "POST"){
$login = $doctor->d_login($_REQUEST['username'],$_REQUEST['password']);
if($login){
header("location:login_tests/Doctor.php");
}
else
{
echo "<script>alert('Login Failed!');</script>";
}
}
}
// Admin login
else{
session_start();
include_once 'classes/admin.php';
$admin = new Admin();
if ($admin->a_session())
{
header("location:admin/Dashboard.php");
}
$admin = new Admin();
if ($_SERVER["REQUEST_METHOD"] == "POST"){
$login = $admin->a_login($_REQUEST['username'],$_REQUEST['password']);
if($login){
header("location:admin/Dashboard.php");
}
else
{
echo "<script>alert('Login Failed!');</script>";
}
}
}
}
// Registration functionalities
else if(isset($_POST['submit2'])){
include_once 'classes/patient.php';
$patient = new Patient();
if ($_SERVER["REQUEST_METHOD"] == "POST"){
$register = $patient->p_register($_REQUEST['name'],$_REQUEST['gender'], $_REQUEST['dob'], $_REQUEST['nic'], $_REQUEST['address'],$_REQUEST['email'], $_REQUEST['username'], $_REQUEST['password']);
if($register){
echo "<script>alert('Registration Successful!');</script>";
}
else
{
echo "<script>alert('Entered email address or username already exists!');</script>";
}
}
}
?>

Answer 1

If I understand you correct, your problem is the 3 session variables $_SESSION['p_login'], $_SESSION['d_login'] and $_SESSION['a_login'].
There is no need to use 3 separate variables, use 1: $_SESSION['user'] = value.
Give it a value according to permission (e.g. patient=1, docter=2, admin=3). Then you only have to test:
if( $_SESSION['user'] < 2 ) only permission for patient pages.
if( $_SESSION['user'] < 3 ) permission for patient pages + docter pages.
if( $_SESSION['user'] < 4 ) permission for all pages.