Look below at where i've done "/*EDIT IS HERE */". You need to run session_start(); at the top of the page to initiate the session; It should really be in a Config file. Then you need to pull it from the database and store it in a $_SESSION global variable.
I know from your G+ you're new at PHP. But one of the worst ways of doing PHP is by using inline PHP. It's not necessarily /wrong/ but you should avoid in-line php. Keep your PHP and HTML Separate, it's a lot easier to sort through errors.
public function login($username, $password) {
global $bcrypt; // Again make get the bcrypt variable, which is defined in init.php, which is included in login.php where this function is called
/* EDIT IS HERE */
$query = $this->db->prepare("SELECT `password`, `AccessLevel`, `id` FROM `users` WHERE `username` = ?");
$query->bindValue(1, $username);
try{
$query->execute();
$data = $query->fetch();
$stored_password = $data['password']; // stored hashed password
$id = $data['id']; // id of the user to be returned if the password is verified, below.
if($bcrypt->verify($password, $stored_password) === true){ // using the verify method to compare the password with the stored hashed password.
/* EDIT IS HERE */
$_SESSION['AccessLevel'] = $data['AccessLevel'];
return $id; // returning the user's id
}else{
return false;
}
}catch(PDOException $e){
die($e->getMessage());
}
}
LOGIN PAGE
<?php
$title = "Login";
/* EDIT IS HERE */
session_start();
require_once 'includes/header.php';
$general->logged_in_protect();
?>
<h1>Login</h1>
<?php
if(empty($errors) === false){
echo '<p>' . implode('</p><p>', $errors) . '</p>';
}
?>
BOTTOM OF LOGIN PAGE
<?php
require_once 'includes/footer.php';
if (empty($_POST) === false) {
$username = trim($_POST['username']);
$password = trim($_POST['password']);
if (empty($username) === true || empty($password) === true) {
$errors[] = 'Sorry, but we need your username and password.';
} else if ($users->user_exists($username) === false) {
$errors[] = 'Sorry that username doesn\'t exists.';
} else if ($users->email_confirmed($username) === false) {
$errors[] = 'Sorry, but you need to activate your account.
Please check your email.';
} else {
$login = $users->login($username, $password);
if ($login === false) {
$errors[] = 'Sorry, that username/password is invalid';
}else {
/* EDIT IS HERE */
//session_regenerate_id(true);
// destroying the old session id and creating a new one
if($_SESSION['AccessLevel'] = "GURU"){
$_SESSION['id'] = $login;
header('Location: index.php');
exit();
}
}
}
}
?>