[~Rexon]

I have to submit some project in tomorrow and I just realised that every logged in user can access the admin page. I have a login table with usertype as a column. What is the best way to do this? Was thinking make a variable in one page then Checking that variable to see if it equals admin. Can't seem to find anything online that can do that so if someone can help id really appreciate it! Thanks

[Leroy Jethro Gibbs]

So any user can login to the admin panel? Is there a separate panel for basic users?

[Kanoplya]

Store an additional variable per user as an admin rank.

Then check if user admin rank == 1, then let him access it, else display something.

[SIM-3468354]

If your admin page is just a link hanging around somewhere do an if statement before you display to check if the user is an admin and if they are show the link, else if they're a user to not display it.
For the actual page run an if statement to check user type before it loads the content and if they are an admin let them see it, else if they're a user redirect them to a no permissions page.

[newQuery]

I would create a function as a middleware named "authenticate" with parameter the ID of the user, then retreive the user in the database and

PHP Code


<?php 
if($user -> usertype != 'admin') header('Location: 403.php'); 


And put the function on the top of the pages that requires admin level
Or better make a router and pass the middleware function to it.

[~Rexon]

Thanks a lot for the fast replies. Much appreciated!

[CodeBinary]

I would create a function as a middleware named "authenticate" with parameter the ID of the user, then retreive the user in the database and

PHP Code


<?php 
if($user -> usertype != 'admin') header('Location: 403.php'); 


And put the function on the top of the pages that requires admin level
Or better make a router and pass the middleware function to it.

I would do something similar to this but be sure to add in an exit; or people can use an extension to block redirects and still see the page.

[newQuery]

I would do something similar to this but be sure to add in an exit; or people can use an extension to block redirects and still see the page.

Indeed, without the die/exit this would be to easily exploitable 👹

[Rushax]

Yup I would create another table in DB for something like isadmin
Have all set to default 0 and if the user is an admin, create a session for isadmin = 1 when user logs in as an admin and use an if statement on the admin page.

[Charger]

Wat? You'd just have a COLUMN in your user table for each user.

There's no need for an extra TABLE.

If you think that you'll have less data, because of the 5 extra cells from 5 users compared to 1 row with 2 cells in an admin table, you are correct, but you'll have to do 2 queries to check if somebody is an admin, which is bad programming.

A simple way would be a column such as 'rank'. It could be 0 = banned, 1 = logged in| 2 = admin.

OP;
Ideally, for larger permision sets, you'd want to create a table of permissions and then assign those to the user. That's a little overkill for this, however.

[SIM-429621]

I have to submit some project in tomorrow and I just realised that every logged in user can access the admin page. I have a login table with usertype as a column. What is the best way to do this? Was thinking make a variable in one page then Checking that variable to see if it equals admin. Can't seem to find anything online that can do that so if someone can help id really appreciate it! Thanks

Most websites do this by checking user ID from the database, you can make all of your admin users have same ID, like "1" and all the other users ID != 1.

[Charger]

Most websites do this by checking user ID from the database, you can make all of your admin users have same ID, like "1" and all the other users ID != 1.

It's not good to hard code data line that. It's better to make it abstract and allow it to be set per user.

[Rushax]

Wat? You'd just have a COLUMN in your user table for each user.

There's no need for an extra TABLE.

If you think that you'll have less data, because of the 5 extra cells from 5 users compared to 1 row with 2 cells in an admin table, you are correct, but you'll have to do an extra lookup queries to check if somebody is an admin, which is bad programming. To be honest, having 4 of those 5 cells as null and just 1 as true for being admin could in theory still consume less data, although I'm not sure about how optimizations work under the hood.

Sorry, yeah 1 extra column not table 😉

[SIM-429621]

It's not good to hard code data line that. It's better to make it abstract and allow it to be set per user.

All admin users would have ID of 1, and for non admin users he could make an integer variable called userID or something like that and make it increase by 1 every time new user is registered and added to the database, that way he could also know which user was registered first. I didn't think for him to manually enter or create random ID for every new user.

[Rushax]

All admin users would have ID of 1, and for non admin users he could make an integer variable called userID or something like that and make it increase by 1 every time new user is registered and added to the database, that way he could also know which user was registered first. I didn't think for him to manually enter or create random ID for every new user.

You would just have a UserID like you said but set it to Auto Increment to allow it to be the primary key.