PHP development skills: How to implement user permission control

PHP Development Tips: How to Implement User Permission Control

Introduction:
In Web applications, user permission control is a very important function. It ensures that users can only access content and features for which they are authorized, while preventing malicious actions by unauthorized users. In this article, we will introduce how to use PHP to implement user permission control and provide specific code examples.

1. Database design:
Before we start writing code, we need to first design the database to store user and permission-related information. Normally, we will design two tables: user table and permission table. The user table is used to store the user's login information, while the permission table is used to define the user's permission level and accessible resources.

Sample code:

CREATE TABLE users (
  id INT(11) AUTO_INCREMENT PRIMARY KEY,
  username VARCHAR(50) NOT NULL,
  password VARCHAR(255) NOT NULL,
  role_id INT(11) NOT NULL
);

CREATE TABLE roles (
  id INT(11) AUTO_INCREMENT PRIMARY KEY,
  name VARCHAR(50) NOT NULL
);

CREATE TABLE permissions (
  id INT(11) AUTO_INCREMENT PRIMARY KEY,
  name VARCHAR(50) NOT NULL,
  resource VARCHAR(50) NOT NULL
);

CREATE TABLE role_permissions (
  id INT(11) AUTO_INCREMENT PRIMARY KEY,
  role_id INT(11) NOT NULL,
  permission_id INT(11) NOT NULL
);

2. Login function:
Before implementing user permission control, we need to write a login function. The user will log into the system using a username and password and their credentials will be verified against the users table in the database.

Sample code:

session_start();

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
  $username = $_POST['username'];
  $password = $_POST['password'];

  // 连接数据库并查询用户信息
  $conn = new mysqli('localhost', 'username', 'password', 'database');
  $query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
  $result = $conn->query($query);

  if ($result->num_rows == 1) {
    $row = $result->fetch_assoc();
    $_SESSION['user_id'] = $row['id'];
    $_SESSION['username'] = $row['username'];
    $_SESSION['role_id'] = $row['role_id'];
    header('Location: dashboard.php');
    exit;
  } else {
    $error = "Invalid username or password";
  }
}

// 如果用户已登录，则跳转至仪表盘（dashboard）页面
if (isset($_SESSION['user_id'])) {
  header('Location: dashboard.php');
  exit;
}

3. Permission verification:
To implement user permission control, we need to verify the user's identity and restrict their access according to the permission level of their role. We can use a middleware or function to accomplish this task.

Sample code:

function checkPermission($resource) {
  // 检查用户是否已登录
  if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
  }
  
  // 查询用户角色的权限
  $conn = new mysqli('localhost', 'username', 'password', 'database');
  $query = "SELECT permissions.name FROM (roles INNER JOIN role_permissions ON roles.id = role_permissions.role_id) INNER JOIN permissions ON role_permissions.permission_id = permissions.id WHERE roles.id = {$_SESSION['role_id']} AND permissions.resource = '$resource'";
  $result = $conn->query($query);
  
  if ($result->num_rows == 0) {
    header('Location: unauthorized.php');
    exit;
  }
}

// 调用权限验证函数来限制访问
checkPermission('dashboard.php');

Conclusion:
Through the above sample code, we demonstrate the basic principles of how to use PHP to implement user permission control. Of course, we can further optimize and expand this system based on actual needs. I hope this article can help you control user permissions when developing web applications.

The above content is for reference only, and the specific implementation method will vary according to actual needs. In actual development, the user permission control system needs to be designed and optimized based on project requirements and security considerations.

The above is the detailed content of PHP development skills: How to implement user permission control. For more information, please follow other related articles on the PHP Chinese website!