Show total messages by user sessions

The problem you are suffering is that you are counting ALL the records in the mjs table that meet condition idnivel_usuario='Empleado' AND estado_mjs='No leido' and you are not taking into account that the recipient is the user in question.

Personally I do not recommend storing the user's username and password in the session variables, it's sensitive information that could be stolen from the server. You should save useful information about the user to whom the session belongs, for example your user ID, usuario.id , with what you save:

Leaving aside those topics (if you want you can ask me and I could make an example of how it would be done correctly) I expose the code that works correctly and a brief explanation:

<!-- proceso para consultar-->
<?php
if (!isset($_SESSION['usuario.id'])) {
  $login = mysql_real_escape_string($_SESSION['login']);
  $password = mysql_real_escape_string($_SESSION['password']);
  $sql = "SELECT id FROM usuario WHERE login='$login' AND 
password='$password'";
  $resultl = mysql_query($sql,$link);//devuelve la consulta
  if ($resultl === false) {
    die(mysql_error());
  }
  $_editar_linea = mysql_fetch_assoc($resultl);
  if ($_editar_linea === false) {
    die('Acceso denegado');
  }
  $_SESSION['usuario.id'] = $_editar_linea['id'];
}
$id_usuario = mysql_real_escape_string($_SESSION['usuario.id']);
$sql = "
  SELECT
    COUNT(*) numero
  FROM
    mjs
  WHERE
    idnivel_usuario = 'Empleado'
  AND
    estado_mjs = 'No leido'
  AND
    fk_cedula = '$id_usuario'
";
$resultl = mysql_query($sql,$link) or die("Error en: $sql: " . 
mysql_error());
$campo = mysql_fetch_assoc($resultl);
?>
 <li><a href="mjs.php">Mjs <span class="new badge blue"><?= htmlspecialchars($campo['numero']) ?>
</span></a></li>
<!--fin proceso para consultar-->

To begin with, you must escape character strings correctly before entering them in a SQL query. Since you do not have prepared queries with variables association (as PDO or mysqli offers) then you must use the function mysql_real_escape_string() .

If you do not, you could suffer SQL injection attacks exposing sensitive information about your company. For starters, since you do not use hash algorithms to store passwords in your database, they could access users and passwords in plain text.

I have created an initial control block to save the query to the database to get the usuario.id . It will only be obtained the first time, the following visits the value stored in the session variables will be reused.

The query SELECT COUNT(*) numero will obtain the number of records without having to overload the MySQL server sending each and every one of the messages to the PHP script (and also saving memory at both ends) with an alias numero to be accessed from the result.

On some sides of your code you open blocks of code { ... } without associating any control commands that are not necessary and, therefore, I have removed them from my response.

Finally, although I know it is a number, I recommend you use htmlspecialchars() whenever you are going to show the information obtained in the document of the database to avoid HTML, CSS and / or JS injection attacks.

I have already resolved friends is as follows

    <!-- proceso para consultar-->
    <?php
    $login= $_SESSION['login'];
    $password=$_SESSION['password'];
$sql = "SELECT * FROM mjs, usuario  WHERE usuario.login='$login' AND 
usuario.password='$password' AND 
usuario.idnivel_usuario='Empleado' AND mjs.estado_mjs='No leido' AND 
mjs.fk_cedula=usuario.id";
$resultl=mysql_query($sql,$link)or die("Error en: $busqueda: " . 
mysql_error());
$campo=mysql_fetch_array($resultl);
$totalmjs=mysql_num_rows($resultl);
{
?>
<li><a href="mjs.php">Mjs <span class="new badge blue"><?=$totalmjs?></span>
</a></li>
<?php
}
?>
<!--fin proceso para consultar-->

I'm closing the topic