the statement, I would believe, should kinda be like:
$sql = mysql_query("SELECT * FROM policies WHERE '$_SESSION[user_level]' = '$ul'");
But this, again, spits out all the records.
When I login as, lets say, user level 2... there should only be 3 files available for me. but instead, it lists out the entire db.