Showing different content based on $_SESSION UserLevel - php

Question

I am having a problem with trying to show different menu options based on UserLevel. I have a mysql database with a users table. The users table contains a UserLevel which will either be set to 0 or 1. But for some reason my php just isn't working. In fact, when I add the php to the menu, it then does not display ANYTHING on the site below the menu. Any advice would be much appreciated.
Code that starts session
<?php
if(!empty($_SESSION['LoggedIn']) && !empty($_SESSION['Username']))
{
?>
<?php include "mainNav.php"; ?>
<center>
<h2> Campaign Updates</h2>
</center>
<div id="campaignPostWrap">
<div id="campaignScrollBox">
<?php
$con=mysqli_connect("localhost","dorians","ds2953!b67P$","aldentec");
// Check connection
if (mysqli_connect_errno())
{
echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
$result = mysqli_query($con,"SELECT * FROM campaigns ORDER BY postDate desc");
while($row = mysqli_fetch_array($result))
{
echo "<div id='campaignPostContainer'>";
echo "<ul class='campaignPostBox'>";
echo "<p class='postInfo'>";
echo "Posted on:";
echo "<li>" . $row['postDate'] . "</li>";
echo "</p>";
echo "<p class='postInfo'>";
echo "Posted by:";
echo "<li>" . $row['postName'] . "</li>";
echo "</p>";
echo "<li class='postEntry'>" . $row['postEntry'] . "</li>";
echo "</ul>";
echo "</div>";
echo "<hr>";
}
mysqli_close($con);
?>
</div>
<?php include "campaignPost.php"; ?>
</div>
<?php include "chat.php"; ?>
<?php
}
elseif(!empty($_POST['username']) && !empty($_POST['password']))
{
$username = mysql_real_escape_string($_POST['username']);
$password = md5(mysql_real_escape_string($_POST['password']));
$checklogin = mysql_query("SELECT * FROM users WHERE Username = '".$username."' AND Password = '".$password."'");
if(mysql_num_rows($checklogin) == 1)
{
$row = mysql_fetch_array($checklogin);
$email = $row['EmailAddress'];
$userlevel = $row['UserLevel'];
$_SESSION['Username'] = $username;
$_SESSION['EmailAddress'] = $email;
$_SESSION['LoggedIn'] = 1;
$_SESSION['UserLevel'] = $userlevel;
echo "<h1>Success</h1>";
echo "<p>We are now redirecting you to the member area. If you are not automatically redirected <a href='index.php'>Click here</a></p>";
header( "refresh:10;url=index.php" );
}
else
{
echo "<h1>Error</h1>";
echo "<p>Sorry, your account could not be found. Please click here to try again.</p>";
}
}
else
{
?>
Menu code that isn't working
<?php session_start(); ?>
<?php
$userlevel = $_SESSION['UserLevel'];
if($userlevel == 0) {
echo "<ul class="mainNav">
<li> Create Character</li>
<li> Create Quest</li>
<li> View Characters</li>
<li> View Quests</li>
<li> Book List</li>
</ul>";
} elseif($userlevel == 1) {
echo "<li> DM Tools</li>";
}
?>
<?php include "greeter.php"; ?>

Answer 1

Your quotes are undoubtedly the problem here:
if($userlevel == 0) {
echo "<ul class="mainNav">
<li> Create Character</li>
<li> Create Quest</li>
<li> View Characters</li>
<li> View Quests</li>
<li> Book List</li>
</ul>";
} elseif($userlevel == 1) {
echo "<li> DM Tools</li>";
}
Notice the syntax highlighting above shows the issue in your string. See how it turns black when it gets to mainNav? That's because mainNav is no longer part of the string. That's a bad thing here.
Look at the first line of your echo:
echo "<ul class="mainNav">
You open a quote and then close it at class=". Now, it's trying to evaluate mainNav as a constant or some other language construct. On top of that, it doesn't know what to do with mainNav as you haven't provided any kind of operators.
Instead, you should do something like:
if($userlevel == 0) {
echo '<ul class="mainNav">
<li> Create Character</li>
<li> Create Quest</li>
<li> View Characters</li>
<li> View Quests</li>
<li> Book List</li>
</ul>';
} elseif($userlevel == 1) {
echo '<li> DM Tools</li>';
}
Alternatively, you could escape every location where there is a non-string-terminating quote like \".
Another option would be to use Heredoc syntax.