How to implement hierarchical permission control in PHP7.0?

When developing web applications, it is often necessary to restrict users' access in the system based on their roles and permissions. Hierarchical permission control is a common permission management method. It divides users into different groups based on roles and permissions, and each group can access different content. In PHP7.0, technologies such as Session and MySQL can be used to implement hierarchical permission control.

1. Design the database

In the database, you usually need to create three tables: user table, role table and permission table. The following is the structural design of the three tables:

(1) User table

CREATE TABLE users (

`id` INT(11) NOT NULL AUTO_INCREMENT,
`username` VARCHAR(50) NOT NULL,
`password` VARCHAR(255) NOT NULL,
`email` VARCHAR(100),
`role_id` INT(11) NOT NULL,
PRIMARY KEY (`id`)

);

(2) Role table

CREATE TABLE roles (

`id` INT(11) NOT NULL AUTO_INCREMENT,
`name` VARCHAR(50) NOT NULL,
PRIMARY KEY (`id`)

);

(3) Permission table

CREATE TABLE permissions (

`id` INT(11) NOT NULL AUTO_INCREMENT,
`name` VARCHAR(50) NOT NULL,
`slug` VARCHAR(50) NOT NULL,
PRIMARY KEY (`id`)

);

Here, we use three tables, among which the user table and the role table use foreign keys to ensure data consistency.

2. Implement permission control

(1) Login

When logging in, the user's user name and password need to be verified, and the user information is saved in the Session. The following is a piece of PHP code:

session_start();
if($_SERVER['REQUEST_METHOD'] == 'POST') {

$username = $_POST['username'];
$password = $_POST['password'];
$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$result = mysqli_query($conn, $sql);
if(mysqli_num_rows($result) > 0) {
    $row = mysqli_fetch_assoc($result);
    $_SESSION['user_id'] = $row['id'];
    $_SESSION['user_role_id'] = $row['role_id'];
    header("Location: dashboard.php");
    exit;
} else {
    $error = "Invalid email or password";
}

}

at After successful login, the user's ID and role ID are stored in the Session for judgment in subsequent visits.

(2) Permission check

In the page that requires permission check, you need to first determine whether the user has logged in and obtain the user's role ID. Then, read the permissions of the role from the database and make a judgment. Here is a piece of PHP code to check if the user has access rights:

session_start();

if(!isset($_SESSION['user_id'])) {

header("Location: login.php");
exit;

}

$role_id = $_SESSION['user_role_id'];
$is_allowed = false;

$sql = "SELECT permissions.slug FROM permissions WHERE permissions.id =
(SELECT role_permission.permission_id FROM role_permission WHERE role_permission.role_id = '$role_id')";

$result = mysqli_query($conn, $sql);

$permissions = array ();

while($row = mysqli_fetch_assoc($result)) {

$permissions[] = $row['slug'];

}

if(in_array('view_dashboard', $permissions)) {

$is_allowed = true;

}

if(!$is_allowed) {

header("Location: unauthorized.php");
exit;

}

Here, we use a subquery to get the permissions of the role ID, and then use the IN keyword and array to determine whether the role has access rights.

(3) Control access

Through the above permission check, we can already determine whether the user has access permission. If he does not have permission, the user needs to be blocked from access. The following is an implementation method:

(1) In the page where access needs to be controlled, put the above permission check code at the top. If the user does not have access permission, jump directly to the unauthorized page.

(2) If the user has access rights, continue executing the code of the page.

(3) In each link and button that needs to be accessed, the permission slug of the link or button needs to be passed as a parameter, for example:

>Add News

Here, if the user does not have the permission to add_news, the link will be hidden.

3. Summary

Hierarchical permission control is a common permission management method that can limit users’ access to the system based on their roles and permissions. In PHP7.0, technologies such as Session and MySQL can be used to implement hierarchical permission control. Through the above implementation method, we can implement hierarchical permission control in web applications, ensuring the security and stability of the system.

The above is the detailed content of How to implement hierarchical permission control in PHP7.0?. For more information, please follow other related articles on the PHP Chinese website!