PHP - Restricting Access To Admin Only

Here is my situation. I have an exam application built in Flash, where after the taker is finished and submits their scores a record is created in MySQL in a log table. Basically there is a column called attempt which is populated with a 1 after they have successfully finished the exam. When this column has a 1, the user is locked out and cannot access the exam when they try and login. The Flash part was built a while back in AS3 and is very cumbersome to try and figure out and make changes, so I have been trying to improve some things on the PHP/MySQL end. What I have now is a php based login which uses if else statements to determine if a user has passed and if they have not uses a DELETE statement to delete their log record and thus they regain access to taking the exam. Code below.

<?php

   if(($pcnt[$i]*100) > 89)
   {
      echo "<span class='green'>you did great!</span>";
   }
   else
   {
     $query_delete = "DELETE FROM log_March2011
USING log_March2011 INNER JOIN roster_March2011
WHERE log_March2011.user_id =roster_March2011.user_id
AND roster_March2011.user_id = '{$_SESSION['user_id']}'"; 
//echo $query_delete; //for debugging test
$result_delete = mysql_query($query_delete) or trigger_error('Query failed: ' .mysql_error());
//$num = mysql_affected_rows($db);
if ($result_delete)
{
echo "<span class='red'>Please review missed questions/sections below</span><br />You can now retake the exam";
}// end if
else
{
echo "No record of taking exam";
} //end else
   }
?>


what I would like to do to improve the application is to be able to implement a set number of attempts allowed before the user is disallowed to take the exam again, but not sure how to implement this or is even possible?

I have a search form. $req is a keyword or an ID number input by user.
As you can see, query checks only for rows where userID matches the current login userID.

My question is, how to transform (not independent query for admins) the query to search all rows if user $access is admin (no matter the administrator's own userID).

Code: [Select]
<?php

$userID="something"; (from session)
$access="something" (from session / user or admin)

$query="SELECT esName, esID, esAddress FROM estates WHERE
    (esName LIKE '$req' OR esID LIKE '$req')
    AND userID='$userID'";

mysql_query($query);

?>

Thanks in advance

is this a good way of doing a simple admin different rights e.g   if secret word then go to adminpage.php


Code: [Select]
session_start();
$captcha = $_POST["captcha"] ;
$secretword = $_SESSION["secretword"] ;

if (strcmp( $captcha, $secretword )) {
  // it's a bot
}
else {
  // matched -- it's a human
}

I have a search code for my site and I want to narrow the scope of the search with a drop down that will allow users to pick a state, ( the sql table includes a state field ) or set the script so that i will only search for results for a particular state.
In the sql select I have tried every way of using WHERE venue_state='NY' but it will not work.
I would really rather allow the users to select a state from a dropdown and then enter the search term - city, zip or venue name.
Thank you for looking

Code: [Select]
<?php
include('config.db.php');
$find  = trim($_GET['find']);
$field = $_GET['field'];


if($find && $field) { // we have search form submitted
   // check for values to prevent sql injection
   $valid_fields = array("venue_zip", "venue_city" , "show_name");
   if(!in_array($field, $valid_fields)) die("Error: Invalid field!");
   
   $rpp = 10; // results per page
   $adjacents = 4;
   
   $page = intval($_GET["page"]);
   if(!$page) $page = 1;
   
   $reload = $_SERVER['PHP_SELF'] . "?find=" . urlencode($find) . "&amp;field=" . urlencode($field);
   
   echo "<h4>Search Results for $find</h4>\n";
   
   
   $find = addslashes($find);
     $result = mysql_query("SELECT *, DATE_FORMAT(`start_date`, '%b %e, %Y') AS s_date FROM craft_shows WHERE $field LIKE '%$find%'");
   if(mysql_num_rows($result) == 0) {
      echo "<p>0 matches found.</p>";
   } else {
      echo "<table class='table7' cellpadding='2'>";
      echo "<tr><td>&nbsp;</td><td><strong>Date</strong></td><td><strong>Show Name</strong></td><td><strong>City</strong></td><td><strong>Attendance</strong></td></tr>";
      echo "<tr><td colspan='5'><hr class=\"hr2\"></td></tr>";
      
      // count total number of appropriate listings:
       $tcount = mysql_num_rows($result);
      
      // count number of pages:
      $tpages = ($tcount) ? ceil($tcount/$rpp) : 1; // total pages, last page number
      
      $count = 0;
      $i = ($page-1)*$rpp;
      while(($count<$rpp) && ($i<$tcount)) {
         mysql_data_seek($result,$i);
         $row = mysql_fetch_array($result);
         $id = $row['id'];
         echo "<tr><td>";
         echo "<a href=\"/show_submits/show_detail.php?id=$id\">Details</a>";
         echo "</td><td>";
         echo $row['s_date'];
         echo "</td><td>";
         echo $row['show_name'];
         echo "</td><td>";
         echo $row['venue_city'];
         echo "</td><td>";
         echo $row['venue_state'];
         echo "</td></tr>";
echo "<tr><td colspan='5'><hr class=\"hr3\"></td></tr>";
         $i++;
         $count++;
      }

      echo "</table><br>";
      
function paginate_one($reload, $page, $tpages) {
   
   $firstlabel = "First";
   $prevlabel  = "Prev";
   $nextlabel  = "Next";
   $lastlabel  = "Last";
   
   $out = "<div class=\"pagin\">\n";
   
   // first
   if($page>1) {
      $out.= "<a href=\"" . $reload . "\">" . $firstlabel . "</a>\n";
   }
   else {
      $out.= "<span>" . $firstlabel . "</span>\n";
   }
   
   // previous
   if($page==1) {
      $out.= "<span>" . $prevlabel . "</span>\n";
   }
   elseif($page==2) {
      $out.= "<a href=\"" . $reload . "\">" . $prevlabel . "</a>\n";
   }
   else {
      $out.= "<a href=\"" . $reload . "&amp;page=" . ($page-1) . "\">" . $prevlabel . "</a>\n";
   }
   
   // current
   $out.= "<span class=\"current\">Page " . $page . " of " . $tpages . "</span>\n";
   
   // next
   if($page<$tpages) {
      $out.= "<a href=\"" . $reload . "&amp;page=" .($page+1) . "\">" . $nextlabel . "</a>\n";
   }
   else {
      $out.= "<span>" . $nextlabel . "</span>\n";
   }
   
   // last
   if($page<$tpages) {
      $out.= "<a href=\"" . $reload . "&amp;page=" . $tpages . "\">" . $lastlabel . "</a>\n";
   }
   else {
      $out.= "<span>" . $lastlabel . "</span>\n";
   }
   
   $out.= "</div>";
   
   return $out;
}
   echo paginate_one($reload, $page, $tpages, $adjacents);
   }
}
?>

So I have a very simple for loop that I am populating a list with levels and exp required to achieve the next level. I have been using a sandbox to test my output and have also created an excel sheet to replicate the data to verify the content. This code was not mine from the beginning and in creating the spreadsheet I discovered the flaw. Below is the code I am trying to fix:

function experience($L, $pres = 0) {
    $a = 0;
    $end = 0;
	for ($x = 1; $x < $L; ++$x) {
        $a += $x * round($x + 5 * pow(4, ($x / 300)));
	}
	if ($x > 199) {
		$a += $x * round($x + 7 * pow(4, ($x / 290)));
	}
	if ($x > 399) {
		$a += $x * round($x + 11 * pow(4, ($x / 280)));
	}
	if ($x > 599) {
		$a += $x * round($x + 19 * pow(4, ($x / 270)));
	}
	if ($x > 799) {
		$a += $x * round($x + 35 * pow(4, ($x / 260)));
	}
	if ($x > 999) {
		$a += $x * round($x + 67 * pow(4, ($x / 250)));
	}
	return round($a / 1.25);
}

Below is the troubleshooting I am attempting to do (Modified and simplified for and while loop):

//for loop
$no = 200;
$a = 0;
for ($x = 1; $x < $no; ++$x) {
    $a += $x + 1;
}
if ($no > 199) {
    $a += $x + 2;
}
echo $a;


//while loop
$no = 200;
$a = 0;
$x = 1;
while (($x - 1) < $no) {
    $a += $x * round($x + 5 * pow(4, ($x / 300)));
    $x++;
    if ($x > 199) {
        $a += $x * round($x + 7 * pow(4, ($x / 290)));
    }
}
echo $a;

Upon request I can also provide snipets of the excel sheet. So the gist of what the issue I am having is this. Between level 199 and 200 the iteration of the loop is running one extra time through the initial formula. As you can tell at level 200, 400, 600, 800 and 1000 I want this formula to change so that it simplifies the amount of exp required to achieve the next level. I can not for the life of me figure out how to restrict the loop while still allowing the values 200 up to run through it for the first 199 iterations.

The output I should get from the primary code for levels 199 through 201 are as follows: 199 =  200 =  201 = 

At level 199 I am good but for whatever reason it runs one additional iteration at the level 1-199 formula and then moves on to the 200 level formula messing up the values.

Any and all help is much appreciated. I am a novice hobbyist at best and have been doing this for many, many years now but sometimes I get stumped. I chalk it up to lack of proper training and time to really be serious with it.

Thanks in advance....NICON