CODEWITHSUNDEEP
phpclassfunctionadmin-rights
Coman Paul
Coman Paul

Reputation: 301

Check user permission in php

How can I create a PHP function or class that checks if a user who is a half-admin (set from a MySQL database) has some rights such as creating a new page, editing, or deleting? I need a function that checks the user permissions and then display the code like this:

  if ($he_can_create_page){
  //continue the script.....
  }else{
  //don`t continue
   }

In present I use sessions like this:

    If($_SESSION['user_type']=='Admin'||$_SESSION['user_type']=='premium'){
 //do stuff
 }else if()......... {
  // ..............
   }

but they become too many if statements, and I want a cleaner code :)

Upvotes: 1

Views: 7859

Answers (4)

Frédéric Clausset
Frédéric Clausset

Reputation: 1096

interface User {

    public function canCreatePage();
    public function canDeletePage();
    public function canEditPage();
    ....
}

class Admin implements User {

    public function canCreatePage(){
        return true;
    }

    public function canEditPage(){
        return true;
    }
    ...
}

class Editor implements User {

     public function canCreatePage() {
          return false;
     }

     public function canEditPage(){
        return true;
     }

     ...

}

then from what you get in the data base 

if ($row['user_type'] == 'Admin') {
   $user = new Admin();
} else if $row['user_type'] == 'Editor') {
   $user = new Editor();
}  ....

in all your pages : 

if ($user->canCreatePage()){
  //continue the script.....
}else{
  //don`t continue
}

If you want to store your user in session the first time you get it from the dataBase

$_SESSION['user'] = serialize($user);

in the next page 

$user = unserialize($_SESSION['user']);

Or you can also just store the id of the user in session and get it back from de DB on every page.

Upvotes: 3

bitWorking
bitWorking

Reputation: 12665

The answer is to use an access control system. There are many different types. The most used (in web development) are ACL (Access control list) and RBAC (Role based access control). The rules can be filled from database or hardcoded.

To give you an idea of how they work look at the examples from Zend Framework: ACL and RBAC. In Zend Framework the ACL is not very different from a RBAC because it also has roles. But normally an ACL is user based and not role based. If you like you can integrate the ACL/RBAC from Zend or other frameworks into your own project.

Read about how yii do it: yii RBAC

Upvotes: 0

Ivan Yonkov
Ivan Yonkov

Reputation: 7034

Add columns in your users table like:

| canEdit | canDelete | canCreate |

with flags 1/0. 1 for true, 0 for false.

select the fields and make checks i.e.:

if($row['canEdit'] = 1) {
//continue (return true)
}
else {
//stop (return false)
}

You can make it a function with params, so you will give the param to the function i.e. $canDelete (which is your $row data) and it checks only that permission

function userPermissions($type)
 if($type=1) {
   return true;
 }
 else {
   return false;
 }


$canCreate = $row['canCreate'];

if(userPermissions($canCreate)) { ...

Upvotes: 0

chandresh_cool
chandresh_cool

Reputation: 11830

Create a generic function an put it in a file which is common for all files something like this

 function pageCreatePermission() {
     if($_SESSION['user_type']=='Admin'||$_SESSION['user_type']=='premium'){

          return true;

     } else { 
          return false;
}

then use this function something like this in your file

if (pageCreatePermission()) {
     //do your stuff
 } else {
     //show error you want
 }

Upvotes: 0

Related Questions