PHP Sessions and Password Salting

[Dentafrice,]

Hi Dentafrice!

I have one problem... I've made a page to see all users, with their info like email etc... It only shows my info, not anybody elses... hmm.

Code.

<?php
session_start();
include 'config.php';
if ($_SESSION['logged_user'] == true) {
    
$query = mysql_query("SELECT `level` FROM `users` WHERE `username` = '".$_SESSION['logged_user']."'");

$rows = mysql_fetch_array( $query );


if ($rows['level'] == 5) {
    
$query = mysql_query("SELECT * FROM `users`");

$rows = mysql_fetch_array($query2);

echo "Username: ".$rows['username']."</br></br> Email: ".$rows['email']."</br></br>Join date: ".$rows['date']."</BR></BR>Signature: ".$rows['signature']."";

} else {
    echo "Don't try and get where you shouldn't be...";
}
}
if ($_SESSION['logged_user'] == false) {
    echo "Not logged in. Redirecting... <meta http-equiv=\"REFRESH\" content=\"1;url=./login.php\">";
    }
?>

I can't see anything wrong... I will learn to spot mistakes though

 <?php
session_start();
include 'config.php';
if ($_SESSION['logged_user'] == true) {
    
$query = mysql_query("SELECT `level` FROM `users` WHERE `username` = '".$_SESSION['logged_user']."'");

$rows = mysql_fetch_array( $query );


if ($rows['level'] == 5) {
    
$query = mysql_query("SELECT * FROM `users`");

while($rows = mysql_fetch_array($query2)) {

echo "Username: ".$rows['username']."</br></br> Email: ".$rows['email']."</br></br>Join date: ".$rows['date']."</BR></BR>Signature: ".$rows['signature']."";
}
} else {
    echo "Don't try and get where you shouldn't be...";
}
}
if ($_SESSION['logged_user'] == false) {
    echo "Not logged in. Redirecting... <meta http-equiv=\"REFRESH\" content=\"1;url=./login.php\">";
    }
?>

[Beau]

Actually, I think it should be this:

 <?php
session_start();
include 'config.php';
if ($_SESSION['logged_user'] == true) {
    
$query = mysql_query("SELECT `level` FROM `users` WHERE `username` = '".$_SESSION['logged_user']."'");

$rows = mysql_fetch_array( $query );


if ($rows['level'] == 5) {
    
$query = mysql_query("SELECT * FROM `users`");

while($rows = mysql_fetch_array($query)) {

echo "Username: ".$rows['username']."</br></br> Email: ".$rows['email']."</br></br>Join date: ".$rows['date']."</BR></BR>Signature: ".$rows['signature']."";
}
} else {
    echo "Don't try and get where you shouldn't be...";
}
}
if ($_SESSION['logged_user'] == false) {
    echo "Not logged in. Redirecting... <meta http-equiv=\"REFRESH\" content=\"1;url=./login.php\">";
    }
?>

[Hitman]

Thanks guys, I know why query2 is there because I was playing around with the querys.

[Invent]

Bored. Bored. Bored.

<?php

session_start();
include('config.php');

if (isset($_SESSION['logged_user']))
{
    
    $query_code = "SELECT `level` FROM `users` WHERE `username` = '".$_SESSION['logged_user']."'"; // Defines the query

    $query = mysql_query( $query_code ) or die("Could not perform SQL Query, error: ".mysql_error()); // Executes the query

    $rows = mysql_fetch_array( $query ) or die("Could not perform SQL Query, error: ".mysql_error()); // Grabs the relevent SQL Data from the query


    if($rows['level'] === 5)
    {
        
        $query_code = "SELECT * FROM `users`"; // Defines the query
        $query = mysql_query( $query_code ) or die("Could not perform SQL Query, error: ".mysql_error()); // Executes the query

        while($rows = mysql_fetch_array($query))
        {

            echo("Username: ".$rows['username']."</br></br> Email: ".$rows['email']."</br></br>Join date: ".$rows['date']."</BR></BR>Signature: ".$rows['signature']);

        }
    
    }
    else
    {
        echo("Don't try and get where you shouldn't be...");
    }
    
}

if (!isset($_SESSION['logged_user'])) // Could've been simpler by doing an elseif statement, but whatever.
{

    echo("Not logged in. Redirecting... <meta http-equiv=\"REFRESH\" content=\"1;url=./login.php\">");

}

?>