title: Implementing User Accounts into Login System Php
body: <p>I want to establish and ENFORCE user permissions on my website.</p>
  
  <p>I have two user groups: buyers and merchants.</p>
  
  <p>For example, for buyers I have (under /login/ dir): </p>
  
  <pre><code>&lt;form method="post" action="check_buyer.php" id="LoggingInBuyer"&gt;
      &lt;div style="width:265px;margin:0; padding:0; float:left;"&gt;
          &lt;label&gt;Username:&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
               &lt;span&gt;&lt;a href="#"&gt;Forgot Username?&lt;/span&gt;&lt;/a&gt;
          &lt;/label&gt;
          &lt;br /&gt;
          &lt;input id="UserReg" style="width:250px;" type="text" name="userName" tabindex="1" class="required" /&gt;
      &lt;/div&gt;
      &lt;div style="width:265px;margin:0; padding:0; float:right;"&gt;
          &lt;label&gt;Password:&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
          &lt;span&gt;&lt;a href="#"&gt;Forgot Password?&lt;/span&gt;&lt;/a&gt;&lt;/label&gt;
          &lt;br /&gt;
          &lt;input id="UserReg" style="width:250px;" type="password"  name="userPass" tabindex="2" class="required" /&gt;
      &lt;/div&gt;
      &lt;div class="clearB"&gt; &lt;/div&gt;
      &lt;input type="submit" style="width:100px; margin:10px 200px;" id="UserRegSubmit" name="submit" value="Login" tabindex="3" /&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p><strong>A php script check_buyer.php:</strong></p>
  
  <pre><code>&lt;?php
  session_start(); #recall session from index.php where user logged include()
  
  function isLoggedIn()
  {
      if(isset($_SESSION['valid']) &amp;&amp; $_SESSION['valid'])
          header( 'Location: buyer/' ); # return true if sessions are made and login creds are valid
      echo "Invalid Username and/or Password";  
      return false;
  }
  
  require_once('../inc/db/dbc.php');
  
  $connect = mysql_connect($h, $u, $p) or die ("Can't Connect to Database.");
  mysql_select_db($db);
  
  $LoginUserName = $_POST['userName'];
  $LoginPassword = mysql_real_escape_string($_POST['userPass']);
  //connect to the database here
  $LoginUserName = mysql_real_escape_string($LoginUserName);
  $query = "SELECT uID, uUPass, dynamSalt, uUserType FROM User WHERE uUName = '$LoginUserName';";
  
  $result = mysql_query($query);
  if(mysql_num_rows($result) &lt; 1) //no such USER exists
  {
      echo "Invalid Username and/or Password";
  }
  $ifUserExists = mysql_fetch_array($result, MYSQL_ASSOC);
  
  function validateUser() {
      $_SESSION['valid'] = 1;
      $_SESSION['uID'] = $uID;
      $_SESSION['uUserType'] = 1; // 1 for buyer - 2 for merchant
  }
  
  $dynamSalt = $ifUserExists['dynamSalt'];  #get value of dynamSalt in query above
  $SaltyPass = hash('sha512',$dynamSalt.$LoginPassword); #recreate originally created dynamic, unique pass
  
  if($SaltyPass != $ifUserExists['uUPass']) # incorrect PASS
  {
      echo "Invalid Username and/or Password";
  }
  
  else {
  validateUser();
  }
  // If User *has not* logged in yet, keep on /login
  if(!isLoggedIn())
  {
      header('Location: index.php');
      die();
  }
  ?&gt;
  </code></pre>
  
  <p><strong>If a valid user is entered.. it goes to /login/buyer dir</strong></p>
  
  <pre><code>&lt;?php
  session_start();
  if($_SESSION['uUserType']!=1)
  { 
      echo 'the userid: ' . $userid . '&lt;br&gt;' . 'the type is ' . $userType . '&lt;br&gt;';
      die("You may not view this page. Access denied.");
  }
  
  function isLoggedIn()
  {
      return (isset($_SESSION['valid']) &amp;&amp; $_SESSION['valid']);
  }
  
  //if the user has not logged in
  if(!isLoggedIn())
  {
      header('Location: index.php');
      die();
  }
  ?&gt;
  
  &lt;?php 
      if($_SESSION['valid'] == 1){
          #echo "&lt;a href='../logout.php'&gt;Logout&lt;/a&gt;";
          require_once('buyer_profile.php');
      }
      else{
          echo "&lt;a href='../index.php'&gt;Login&lt;/a&gt;";
      }
  ?&gt;
  </code></pre>
  
  <p>The problem is once logged in as a <code>buyer</code>, i can just type in: <code>login/merchant</code> and it will take me there, even though the field in the session <code>$_SESSION['uUserType']</code> is constantly being re-validated to <code>= 1</code>. </p>
  
  <p>How do I stop users from just typing <code>login/merchant</code> in the url and they can get access to that?</p>