Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTo let both Member and Secretary accounts access a PHP page, deny access only when the user is not logged in or their role is outside that allow-list. Comparing a role against both permitted names with || makes the denial condition true for either role.
Why the original condition blocks both roles
This condition denies access when the session is missing or the role differs from either permitted value:
As an Amazon Associate I earn from qualifying purchases.
if (
!isset($_SESSION['account_loggedin']) ||
$_SESSION['account_loggedin'] !== true ||
$_SESSION['account_role'] != 'Member' ||
$_SESSION['account_role'] != 'Secretary'
) {
// denial branch
}A single-valued role cannot be both Member and Secretary. If it is Member, it is not Secretary; if it is Secretary, it is not Member. So at least one of the two != tests is always true, and the OR condition enters the denial branch. The relevant discussion is in the SitePoint Forums thread.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUse a strict allow-list
Start the session before reading session values, then allow the request only if authentication is valid and the role matches one of the permitted names:
#1 Best Overall
session_start();
$loggedIn = isset($_SESSION['account_loggedin'])
&& $_SESSION['account_loggedin'] === true;
$role = $_SESSION['account_role'] ?? '';
$allowedRoles = ['Member', 'Secretary'];
if (!$loggedIn || !in_array($role, $allowedRoles, true)) {
header('Location: login.php');
exit;
}
// Protected page code follows here.The third argument to in_array() enables strict comparison, checking both value and type instead of PHP’s default loose comparison. The PHP manual for in_array() recommends strict mode unless the types of all values are known with certainty. Keep exit after the redirect; otherwise the protected page could continue running.
The equivalent explicit condition is:
if (
!$loggedIn ||
($role !== 'Member' && $role !== 'Secretary')
) {
header('Location: login.php');
exit;
}This denies when the role is neither permitted role. The array version is easier to extend when the allow-list grows.
Rank #2
Keep authentication separate from authorization
Authentication establishes whether a request belongs to a logged-in user. Authorization checks what that user may access. A session flag can help establish the former, but a role-based page check must also establish the latter.
For a production page, keep a user ID in the session and load the user’s current role from trusted server-side data on each request. That way, a demotion, promotion, or ban can take effect without waiting for an old role stored in the session to expire:
session_start();
$userId = $_SESSION['user_id'] ?? null;
if (!is_int($userId) && !ctype_digit((string) $userId)) {
header('Location: login.php');
exit;
}
// Load the current role from the database using a parameterized query.
$currentRole = loadRoleForUser((int) $userId);
$allowedRoles = ['Member', 'Secretary'];
if (!in_array($currentRole, $allowedRoles, true)) {
http_response_code(403);
exit('Forbidden');
}Implement loadRoleForUser() with a parameterized database query; the example indicates where the trusted lookup belongs rather than providing a database-specific implementation. Do not use a role supplied through $_GET, $_POST, or a hidden form field as the authorization decision. Those values are controlled by the client.
Protect the session that carries the identity
Authorization checks rely on the session identifying the right user. PHP’s session-security guidance discusses strict session mode, timestamp-based session management, and regenerating session IDs with recommended procedures. Regenerate the ID at login and after privilege changes.
Rank #4
Configure session cookies for the deployment: use Secure over HTTPS, HttpOnly to prevent JavaScript access, and an appropriate SameSite policy. PHP documents these controls, along with session.use_strict_mode, in its session INI settings. Cookie protections reduce session risk but do not replace the per-request role check.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
