How do i prevent tampering using an admin flag?

Question

Hello,

In my users table I have a true/false boolean flag which signifies whether the logged on user is Admin or not. Basically, even Admin and other users has access to database because it's a small college website. How do i ensure that general users don't modify the flag? Is storing admin flag a correct way of doing? If i keep password and username for database then also it's risky because other users even have access to website folder so they can refer to username and password in connection string.

Thanks in advance :)

Answer 1

If they have full access to your database, editing the "admin flag" is the least of your problems. What's to stop them from editing everything else? Certainly not your admin flag.

Is storing admin flag a correct way of doing?

No, not even close. The proper way is to set up separate mysql users with only the limited permissions they need. Use file permissions to prevent people from reading the login info from the web folders.

Additionally you could use a .htaccess file to control access to the admin section.

Answer 2

Based on ur requirement u need to create role based application.

define types of users

and give different permissions to different users.