PHP Registration with sessions and user access - php

Question

Im trying to understand how to build a user registration with PHP and MySQL.
I have built a form that the user can fill out and the information is then stored in my table.
error_reporting(E_ALL);
include_once ('connection.php');
// Required field names
$required = array('firstname', 'lastname', 'email', 'password', 'accounttype');
// Loop over field names, make sure each one exists and is not empty
$error = false;
foreach($required as $field) {
if (empty($_POST[$field])) {
$error = true;
}
}
if ($error) {
echo "All fields are required.";
} else {
$firstname = $_POST['firstname'];
$lastname = $_POST['lastname'];
$email = $_POST['email'];
$password = md5($_POST['password']);
$accounttype = $_POST['accounttype'];
$query = "INSERT INTO users(firstname,lastname,email,password,accounttype) VALUES (:firstname,:lastname,:email,:password,:accounttype)";
$stmt = $dbh->prepare($query);
$stmt->bindParam(':firstname', $firstname);
$stmt->bindParam(':lastname', $lastname);
$stmt->bindParam(':email', $email);
$stmt->bindParam(':password', $password);
$stmt->bindParam(':accounttype', $accounttype);
$stmt->execute();
if(!$query){
echo 'Whoops, something went wrong!';
} else {
echo $accounttype;
if($accounttype == '1'){
header ('Location: /england/dashboard.php');
exit;
};
if($accounttype == '2'){
header ('Location: /ireland/dashboard.php');
exit;
};
};
};
When the users completes the form they're either reidrected to a different page based on their account type.
On those pages I need to somehow check to see if the user is of accounttype 'X'. So if they land in
header ('Location: /ireland/dashboard.php');
their account type value will be equal to 2, so only people with an account type of 2 can visit the above mentioned.
I've read about session variables, but where do I set these?

Answer 1

session_start(); // this at top of page
if($accounttype == '1'){
$_SESSION['accountType'] = 1; // or $accounttype
header ('Location: /england/dashboard.php');
exit();
};
if($accounttype == '2'){
$_SESSION['accountType'] = 2; // or $accounttype
header ('Location: /ireland/dashboard.php');
exit();
};
In england/dashboard.php
session_start();
if($_SESSION['accountType'] !== 1) header('location: login.php');
In ireland/dashboard.php
session_start();
if($_SESSION['accountType'] !== 2) header('location: login.php');

Answer 2

Start the session where you built form ,
session_start();
$_SESSION['account_type'] = 2;
and in the dashboard.php just get your session variable to check the account type.
if(($_SESSION['account_type'] == 2)) {
header('`dashboard.php');
} else {
// someother page or restrict access
}

Answer 3

simply begin your php script with session_start();
assign session vars with $_SESSION['whatever'] = "something";
You must begin your script with session_start(); on any page you wish to use session variables though.
To destroy a session and all associated vars simply use session_destroy();

Answer 4

One way to do this:
Use a 'Head/Config' file that you require_once() on every page
In this file store info in the session variable like this:
$_SESSION['myCustomValue'] = $accountType;
Then based on what is stored in there you can redirect:
if ($_SESSION['myCustomValue'] = 2):
header ('Location: /ireland/dashboard.php'); // oh yea!
endif;

Answer 5

First at least SHA1 hash the password. Store the result of that and not the actual password in your database. To test for login, you SHA1 hash what they gave you and compare the hashes. You should also salt the password before hashing, but just hashing would be a good start.
Also give your user record an id that can be used as the primary key.
You basically do a start_session() first thing in your script. This will either start a new one or attach to the one they have.
Then after they login/register and you know what their user id is store it in the session with $_SESSION['userid'] = $userid;
To test for login: isset($_SESSION['userid']) will return true.
Edit
Once you alter your table to have the id as an auto incrementing, primary key, your insert above does not need to change, but you get that ID by calling $dbh->lastInsertId()

Answer 6

You need to decide what you want to store in session data. When a person completes the form, passes validation and is saved in the DB, you might want to do this:
if(!$query) {
echo 'Whoops, something went wrong!';
} else {
session_start();
$_SESSION['account_type'] = $accounttype;
// Carry on functionality...
}
And at the beginning of your script, you can prevent existing users accessing the registration form:
session_start();
if(isset($_SESSION['account_type'])) {
header('Location: /ireland/dashboard.php');
}