User Levels in App

[Pico_Train]

Hi there,

I'm about to begin an app that requires different user levels.

Now I have the users table and user_right table.

My users table has user_right_id_fk field and I store that in a session variable so I can check on a per page basis if they have the rights to do certain things, otherwise throw them out to a generic "you don't have the right to view this" page.

Now, is the way I am doing it any good? Or am I creating myself headaches down the road?

Is there a better way?

Thanks!

[rocknbil]

The only thing I'd add is if they don't have the permissions to view a page (which is a more friendly word than rights :-) ) then don't show any links to it. Nothing more frustrating than a bunch of links to stuff I can't use.

Use integer values for your user levels if you're not already.

users
id|email|etc

user_permissions
id|user_id|level
1|1234|0
2|2342|1
3|6467|3

$_SESSION['permissions'] = get_user_perms($userid); // your function

if (is_numeric($_SESSION['permissions'])) { 
 if ($_SESSION['permissions']>0) { 
 // show level 1 links, also available to 2 and 3 
 } 
 if (($_SESSION['permissions']>1) { 
 // show level 2 links, also available to 3 
 } 
 if (($_SESSION['permissions']>2) { 
 // show level 3 links 
 } 
} 
else { output_login_page(); } 

You might want to add the error page anyway as a failsafe, easy enough, make something like the above an include and it goes at the tops of all pages. This would allow you to add levels higher than 3 later in the program's life.

I also don't see why you'd need to store the session id for anything but logging.

[penders]

The only thing I'd add is if they don't have the permissions to view a page ... don't show any links to it.

I'd possibly add... if a user is logged in and they don't have the perms to view a page then don't show any links to it.

Depending how your app is structured, if you allow non-logged in (guest users), then it could be useful to the user that they see all links despite some of those pages requiring authentication.

[Pico_Train]

Ok yeah, thanks guys, that was the plan too.