How to handle different roles with different previliges in PHP?

Question

I would like to know how we can create different "user Roles" for different users in PHP. example:

Administrator can create all types of users, add, view, manipulate data, delete managers, viewers, and workers, etc

Managers can only create, workers and viewers, can add and view data, workers can't create new users, but can only add data and view data,

Viewers can only view data that has been added to the DB by workers, managers and administrators.

I though its better to use different sessions like :

$_SESSION['admin']
$_SESSION['manager']
$_SESSION['worker']
$_SESSION['viewvers']

and for every page check which of them have a true or yes value, but I want to know how do they do it in real and big projects??? is there any other way???

Answer 1

Depends on the grand schema of things (hoping y'all got that, lol). Typically, user's have an identifier as to what level they are. Such as a 'status' or 'type' field.

$_SESSION['loggedInUser']['type']

that type is typically numeric. 1 may be regular users, 2 might be moderators, 3 admins, etc

The rest is how you manage it in your code. Frameworks like cakephp will give you access to the logged in user via their auth object, and you can have whatever data you want :)

i know this is very superficial, but alas, the question was as well. Hope it helps :)

Answer 2

you should role like in $_SESSION['Role'] and fill it upon login. then check everytime does this role have priviligies to do the operation.

Answer 3

A common way to implement user privileges is "user levels" where each user level is something that can be represented by an int. For example:

0 = guest, no privileges
1 = standard user, read-only access
9 = power user, read/write access
10 = admin, all access

Throughout your application you then check the user access level and allow or deny access accordingly. It gets more complicated if you have some areas where the privileges are not necessarily hierarchical.

In this situation, you can check your session variable (after the user has authenticated of course) for, say $_SESSION['user_level'];