Access policy in PHP and MySQL.

Question

I am slightly confused on how to setup my table. I have three roles which can be selected through checkbox. While registration.... if user selects one and two... then those pages should be visible, if he selected one and three then those pages and if selects anyone of them then those alone...

Let us name the page 1 as client management Page 2 Invoice Management Page 3 View report

Should i have seperate fields for these three or one is enough.

Thanks

Answer 1

Keeping separate fields for each roles is not a good idea. If you would want to add another role you will need to update your database structure.

You can do two things IMO:

SET field

Create an set field where you can define any roles the user have in just one value, this will still require ALTERing the table if you want to add a new role but at least it won't add another field to the table

M:M table

Create M:M (many to many) table that will connect roles with users, this solution doesn't require changing the db if you want to add another role

CREATE TABLE `users` (
    id INT AUTO INCREMENT,
    login VARCHAR(100) NOT NULL,
    password CHAR(32) NOT NULL,
    PRIMARY KEY (id)
)

CREATE TABLE `roles` (
    id INT AUTO INCREMENT,
    name VARCHAR(50) NOT NULL,
    PRIMARY KEY (id)
)

CREATE TABLE `user_roles` (
    user_id INT,
    role_id INT
)

I would also add constraint to the user roles table that will make sure that correct ids are in that table but I won't add them in that example to just keep it simple. More details on that you can find here