How to validate session in php? - php

Question

I want to some users can access to a page and others user can't but I don't know how to valide my session variable in my index for example. How I have to the top of my index.php page to validate that only some users can see that page?
This is the process for my login
<?php
session_start();
include 'db.php';
if(isset($_POST['btn_entrar']))
{
$user=$_POST['usuario'];
$password=$_POST['contraseña'];
$admin='Administrador';
$vendedor='Vendedor';
$query_admin = $mysqli->query("SELECT * FROM empleado WHERE usuario='$user'
AND contra='$password' AND cargo='$admin'") or die($mysqli->error());
$query_ven = $mysqli->query("SELECT * FROM empleado WHERE usuario='$user'
AND contra='$password' AND cargo='$vendedor'") or die($mysqli->error());
if(mysqli_num_rows($query_admin)==1)
{
$row = $query_admin->fetch_array();
$_SESSION['user_id'] = $row['id_empleado'];
header("location: index.php");
}
else if(mysqli_num_rows($query_ven)==1)
{
header("location: index_empleados.php");
}
else
{
echo "<script>alert('Usuario o contraseña son incorrectos')</script>";
header("location: login.php");
}
}

Answer 1

First, there's no reason to do two queries. Just do one query to check the username and password. Then you can test $row['cargo'] to determine what kind of user they are.
So if the username and password query is found, you can do something like:
$_SESSION['cargo'] = $row['cargo'];
Then at the top of pages that should only be visible to administrators, you can do:
<?php
session_start();
if ($_SESSION['cargo'] != "Administrador") {
header("Location: index_empleados.php");
exit;
}