title: Admin only access php
body: <p>I'm trying to code a page that only allows user with Admin rights (recorded as admin against role in DB). If they are admin then photos are pulled from database for approval. If not admin then they get redirected to admin page and don't see images.</p>
  
  <p>At the moments anyone logged in can view the page and images are displayed. What am I doing wrong?</p>
  
  <p>Thanks</p>
  
  <pre><code>&lt;?php
  
  session_start();
  
  
  
  $isLoggedIn = isset($_SESSION['first_name']) &amp;&amp; isset($_SESSION['username']);
  $username = $_SESSION['username'];
  
  if ($isLoggedIn &amp;&amp; $_SESSION['username']){
  
  
  echo "Welcome ".$_SESSION['first_name']."&lt;br&gt;&lt;a href='login/logged_out.php'&gt;log     
  out&lt;/a&gt;";
  
  }
  
  
  $username = $_SESSION['username'];
  //var_dump($username);
  
  include("..\connection\connection.php");
  
  
  // Connect to server and select database.
  
  mysql_connect($host, $username, $password)or die("cannot connect"); 
  
  mysql_select_db($db_name) or die("cannot select DB");
  
  $query=mysql_query("SELECT * FROM users WHERE username = '$username' AND role =   
  'admin'");
  
  echo(mysql_error());
  
  $num_rows = mysql_num_rows($query);
  
  
  if ($num_rows =1){                  
  
  include("..\connection\connection.php");
  
  // Connect to server and select databse.
  mysql_connect($host, $username, $password)or die("cannot connect"); 
  mysql_select_db($db_name) or die("cannot select DB");
  
  
  $photo=mysql_query("SELECT * FROM images WHERE approved='N'");
  
  echo(mysql_error());
  
  $numrows = mysql_num_rows($photo);//counts the number or rows returned from database   
  matching the mysql_query.
  
  if ($numrows==0){
  
  echo "There are no images awaiting approval.";
  }
  
  
  while($get_photo=mysql_fetch_array($photo)){?&gt;
  
  &lt;a href="approve_image_submit.php?images=&lt;?php echo $get_photo['big_images']; ?&gt;"   
  target=""&gt;&lt;img src="&lt;? echo $get_photo['url']; ?&gt;" title=""&gt;
  
  
  &lt;? } ?&gt;
  &lt;?
  }else{
  
  
  die ("You do not have permission to view this page. Redirect to index.phph Click &lt;a  
  href='login/login_page.php'&gt;here&lt;/a&gt; to log in.");
                  //
  
  
  }
  ?&gt;
  </code></pre>