Codeigniter login system with session to redirect user to page if password correct

Question

I created a login system but every time I setup an if statement it loops back to the login page when I enter correct password. I need the index function in the controller, the list_employee function and View_employee function to redirect user to login page if they access it directly but if they enter correct password allow them to go to it.

user_authentication controller

<?php

session_start(); //we need to start session in order to access it through CI

Class User_Authentication extends CI_Controller {

public function __construct() {
parent::__construct();

// Load form helper library
$this->load->helper('form');

// Load form validation library
$this->load->library('form_validation');

// Load session library
$this->load->library('session');

// Load database
$this->load->model('login_database');

}

// Show login page
public function user_login_show() {
$this->load->view('login_form');
}

// Show registration page
public function user_registration_show() {
$this->load->view('registration_form');
}

// Validate and store registration data in database
public function new_user_registration() {

// Check validation for user input in SignUp form
$this->form_validation->set_rules('name', 'Name', 'trim|required|xss_clean');
$this->form_validation->set_rules('username', 'Username', 'trim|required|xss_clean');
$this->form_validation->set_rules('email_value', 'Email', 'trim|required|xss_clean');
$this->form_validation->set_rules('password', 'Password', 'trim|required|xss_clean');
if ($this->form_validation->run() == FALSE) {
$this->load->view('registration_form');
} else {
$data = array(
'name' => $this->input->post('name'),
'user_name' => $this->input->post('username'),
'user_email' => $this->input->post('email_value'),
'user_password' => $this->input->post('password')
);
$result = $this->login_database->registration_insert($data) ;
if ($result == TRUE) {
$data['message_display'] = 'Registration Successfully !';
$this->load->view('login_form', $data);
} else {
$data['message_display'] = 'Username already exist!';
$this->load->view('registration_form', $data);
}
}
}

// Check for user login process
public function user_login_process() {

$this->form_validation->set_rules('username', 'Username', 'trim|required|xss_clean');
$this->form_validation->set_rules('password', 'Password', 'trim|required|xss_clean');

if ($this->form_validation->run() == FALSE) {
$this->load->view('login_form');
} else {
$data = array(
'username' => $this->input->post('username'),
'password' => $this->input->post('password')
);
$result = $this->login_database->login($data);
if($result == TRUE){
$sess_array = array(
'username' => $this->input->post('username')
);

// Add user data in session
$this->session->set_userdata('logged_in', $sess_array);
$result = $this->login_database->read_user_information($sess_array);
if($result != false){
$data = array(
'name' =>$result[0]->name,
'username' =>$result[0]->user_name,
'email' =>$result[0]->user_email,
'password' =>$result[0]->user_password
);
redirect('employee');
}
}else{
$data = array(
'error_message' => 'Invalid Username or Password'
);
$this->load->view('login_form', $data);
}
}
}

// Logout from admin page
public function logout() {

// Removing session data
$sess_array = array(
'username' => ''
);
$this->session->unset_userdata('logged_in', $sess_array);
$data['message_display'] = 'Successfully Logout';
$this->load->view('login_form', $data);
}
}

?>

employee controller

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class Employee extends CI_Controller {

    function __construct()
    {
        parent::__construct();
        $this->load->model('login/employee_model');

        }   

    //Shows the dashboard
    public function index()
    {

        $this->load->view('header');
        $this->load->view('employee');
        $this->load->view('login/footer');



    }
    //Insert the employee 
    public function  insert_employee()
    { 


        $data=array('name'=>$this->input->post('name'),
            'LanId'=>$this->input->post('LanId'),
            'reason'=>$this->input->post('reason'),
            'PepNumber'=>$this->input->post('PepNumber'),
            'Employee_Number'=>$this->input->post('Employee_Number'),
            'department'=>$this->input->post('department'),

            'status'=>1);
        //print_r($data);

        $result=$this->employee_model->insert_employee($data);
        if($result==true)
        {
            $this->session->set_flashdata('msg',"Employee Records Added Successfully");
            redirect('employee');

        }
        else
        {

            $this->session->set_flashdata('msg1',"Employee Records Added Failed");
            redirect('employee');


        }
    }
    //List of Employees 
        public function list_employees()
    {



            $data['employee']=$this->employee_model->get_employee();
            $this->load->view('header');
            $this->load->view('list_of_employees',$data);
             $this->load->view('login/footer');

    }
    //List of Employees 
        public function viewlist_employees()
    {


            $data['employee']=$this->employee_model->get_employee();
            $this->load->view('header');
            $this->load->view('viewlist_of_employees',$data);
             $this->load->view('login/footer');

    }

    public function delete_employee()
    {
        $id=$this->input->post('id');
        $data=array('status'=>0);
        $result=$this->employee_model->delete_employee($id,$data);
        if($result==true)
        {
            $this->session->set_flashdata('msg1',"Deleted Successfully");
            redirect('employee/list_employees');

        }
        else
        {

            $this->session->set_flashdata('msg1',"Employee Records Deletion Failed");
            redirect('employee/list_employees');


        }

    }
    public function edit_employee()
    {
        $id=$this->uri->segment(3);
        $data['employee']=$this->employee_model->edit_employee($id);
        $this->load->view('header',$data);
        $this->load->view('edit_employee');
    }
    public function  update_employee()
    {
        $id=$this->input->post('id');

        $data=array('name'=>$this->input->post('name'),
            'LanID'=>$this->input->post('LanID'),
            'reason'=>$this->input->post('reason'),
            'PepNumber'=>$this->input->post('PepNumber'),
            'Employee_Number'=>$this->input->post('Employee_Number'),
            'department'=>$this->input->post('department'),

            'status'=>1);

        $result=$this->employee_model->update_employee($data,$id);
        if($result==true)
        {
            $this->session->set_flashdata('msg',"Employee Records Updated Successfully");
            redirect('employee/list_employees');

        }
        else
        {

            $this->session->set_flashdata('msg1',"No changes Made in Employee Records");
            redirect('employee/list_employees');


        }
    }

}
?>

login_database model

<?php

Class Login_Database extends CI_Model {

// Insert registration data in database
public function registration_insert($data) {

// Query to check whether username already exist or not
$condition = "user_name =" . "'" . $data['user_name'] . "'";
$this->db->select('*');
$this->db->from('user_login');
$this->db->where($condition);
$this->db->limit(1);
$query = $this->db->get();
if ($query->num_rows() == 0) {

// Query to insert data in database
$this->db->insert('user_login', $data);
if ($this->db->affected_rows() > 0) {
return true;
}
} else {
return false;
}
}

// Read data using username and password
public function login($data) {

$condition = "user_name =" . "'" . $data['username'] . "' AND " . "user_password =" . "'" . $data['password'] . "'";
$this->db->select('*');
$this->db->from('user_login');
$this->db->where($condition);
$this->db->limit(1);
$query = $this->db->get();

if ($query->num_rows() == 1) {
return true;
} else {
return false;
}
}

// Read data from database to show data in admin page
public function read_user_information($sess_array) {

$condition = "user_name =" . "'" . $sess_array['username'] . "'";
$this->db->select('*');
$this->db->from('user_login');
$this->db->where($condition);
$this->db->limit(1);
$query = $this->db->get();

if ($query->num_rows() == 1) {
return $query->result();
} else {
return false;
}
}

}

?>

employee_model

<?php

class Employee_model extends CI_Model 
{

    public function insert_employee($data)
    {
        $this->db->insert('employee_list',$data);
        return ($this->db->affected_rows() != 1 ) ? false:true;
    }
    public function get_employee()
    {
        $this->db->select('*');
        $this->db->from('employee_list');
        $this->db->where('status',1);

        $query =$this->db->get();
        return $query->result();
    }
    public function delete_employee($id,$data)
    {
        $this->db->where('id',$id);
        $this->db->update('employee_list',$data);
        return ($this->db->affected_rows() != 1 ) ? false:true;
    }
    public function edit_employee($id)
    {
        $this->db->select('*');
        $this->db->from('employee_list');
        $this->db->where('id',$id);
        $this->db->where('status',1);
        $query =$this->db->get();
        return $query->result();

    }
    public function update_employee($data,$id)
    {
        $this->db->where('id',$id);
        $this->db->update('employee_list',$data);
        return ($this->db->affected_rows() != 1 ) ? false:true;
    }
}

Answer 1

add if statement with logged_in and a redirect to login form if it is incorrect

public function index()
        {
             if($this->session->userdata('logged_in'))
            {      
            $this->load->view('header');
            $this->load->view('employee');
            $this->load->view('login/footer');

           }else{
               redirect('user_authentication/user_login_show');

            }

        }

Answer 2

Best Practice is to add the check in the constructor of your controller in CI. here is the example of mine.

 public function __construct() {
    parent::__construct();
    if (!$this->session->userdata('user_data')) {
        return redirect('login');
    }

    $this->load->model('customer_model');
}

you can add the else statement to redirect to the dashboard or what the resulting page if user is logged in.