php - Show content only if logged in -

hello have question. have set login system cookies , works. wonder there more clean version of doing this.

<? include('../config/db_config.php');  $username = $_cookie['user']; $password = $_cookie['pass'];  $result = mysql_query("select * users isadmin = 1");  while($row = mysql_fetch_array($result)) {     if($username == $row['username'] && $password == $row['password'])     {         //user entered correct username , password         echo("allow");     }     else     {         //user entered incorrect username , password         echo("deny");     } } ?> 

you see want content shown if logged in admin. what, way of doing echo'ing out html/php/javascript instead of echoing allow because if include("somepage.php") there page still avialable usage without logging in, , if same check there still echo'ing out everything.

• why loading every user, comparing username , password? wouldn't easier load single user matching username , password?

• loading single user allow remove while().

• in php, don't use mysql_query; do use pdo (if need, google know why it's better).

• check input (quite optional here, agree).

• do never store passwords in plain text format.

you can (i haven't used php/pdo years, code may inexact):

if (strlen($username)> 128) {     // wrong. username long. }  $hash = sha1($password); $sth = $dbh->prepare('if exists(select * users isadmin = 1 , username = :username , password = :password) select 1 else select 0'); $sth->bindparam(':username', $username, pdo::param_str, 128); $sth->bindparam(':password', $hash, pdo::param_str, 40); $sth->execute(); $isfound = $sth->fetchall(); if ($isfound) {     // user entered correct username , password.     echo 'allow'; }