Question

在这里搜索并尝试不同的方法但没有成功，我想我会问。

这样的事情会很完美，但我不知道如何设置它以检查用户角色

<?php
    if (roles->getUserRole(reports)) { echo "<li><a href='/page5'>Reports</a></li>"; }
?>

我想根据数据库中的用户角色显示/不显示菜单项。我把它设置在数据库中

（管理员）角色 - 1或（超级管理员）角色2

enter image description here

这是login.php

    <?php
session_start(); // Starting Session

    $error=''; // Variable To Store Error Message
        if (isset($_POST['submit'])) {
        if (empty($_POST['username']) || empty($_POST['password'])) {
    $error = "Username or Password is invalid";

    }  else  {

        // Define $myusername and $mypassword
        $myusername=$_POST['username'];
        $mypassword=$_POST['password'];

    // Establishing Connection with Server by passing server_name, user_id and password as a parameter
    $connection = mysql_connect("localhost", "db_admin", "db-password");
    // To protect MySQL injection for Security purpose

    $myusername = stripslashes($myusername);
    $mypassword = stripslashes($mypassword);
    $myusername = mysql_real_escape_string($myusername);
    $mypassword = mysql_real_escape_string($mypassword);

    // Selecting Database
    $db = mysql_select_db("db_database", $connection);

    // SQL query to fetch information of registerd users and finds user match.
    $query = mysql_query("select * from members where password='$mypassword' AND username='$myusername'", $connection);
    $rows = mysql_num_rows($query);
        if ($rows == 1) {
    $_SESSION['login_user']=$myusername; // Initializing Session
        header("location: dashboard.php"); // Redirecting To Other Page

    } else {

    $error = "Username or Password is invalid";
}
    mysql_close($connection); // Closing Connection
}
}
?>

dashboard.php顶部的代码

<?PHP
session_start();
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true) {

  } else {
header ("Location: index.php");
}
?>

我想根据用户角色显示/隐藏菜单项。

       <li>
          <a href="employees.php" class="dropdown-toggle" data-toggle="dropdown" data-hover="dropdown">
            <i class="fa fa-user"></i>
            Employees
            <span class="caret"></span>
          </a>

          <ul class="dropdown-menu"> 
          <li><a href="employees.php"><i class="fa fa-th-list nav-icon"></i> See All</a></li>  
            <li><a href="add-employee.php"><i class="fa fa-plus-square-o nav-icon"></i> Add</a></li>
            <li><a href="edit-employee.php"><i class="fa fa-edit nav-icon"></i> Edit</a></li>
          </ul>
        </li>

作为附注（因为我知道会提到它）我知道我的代码应该是mysqli，当我把它全部工作时我将把我的网站切换到那个。我现在正在学习它。

Answer 1

首先，您应该在会话中存储超过用户登录的内容：如果验证成功，则使用

之类的东西创建一个唯一的令牌

    // SQL query to fetch information of registerd users and finds user match.
        $query = mysql_query("select * from members where password='$mypassword' AND username='$myusername'", $connection);
        $rows = mysql_num_rows($query);
        if ($rows == 1) {
            $_SESSION['login_user'] = $myusername; // Initializing Session
            $token = md5(uniqid());
            $_SESSION['token'] = $token;
            $query = mysql_query("update token from members where username='$myusername' set token = '$token'", $connection);
            header("location: dashboard.php"); // Redirecting To Other Page
        } else {
    ...
    }

此令牌将用于验证您网站的每个其他网页上的身份验证，如果没有它，您只是假设如果您的会话中有login_name，那么身份验证是正确的。

当然，这会起作用，但是根本不安全，如果用户想要更新他的密码，那么已经登录同一帐户的其他计算机将永远不会断开连接。

使用令牌，您可以在以后更改密码时重置它。

在其他页面中，您可以使用会话用户名来获取当前令牌和当前角色。

// Check for a session
 if(isset($_SESSION['login_user']) && isset($_SESSION['token']))
{
     // SQL query to fetch information of registerd users and finds user match.
                $query = mysql_query("select * from members where  username='".$_SESSION['login_user']."'", $connection);
                $rows = mysql_num_rows($query);
                if ($rows == 1) {
                    $row = mysql_fetch_array($query , MYSQL_BOTH);
                    if($row['token'] != $_SESSION['token'])
                    {
                        // Incorrect token, disconnect the user
                        unset($_SESSION['login_user']);
                        unset($_SESSION['token_user']);
                        // Make redirection and stuff
                    }
                    else
                    {
                        // User still logged
                           $role = $row['role'];
                        // You can then use that variable later in page
                        // If $role == 1, Admin, show menu, prevent function access, ect
                    }
               }
}

希望有所帮助！

根据数据库php / mysql中的用户角色显示div

1 个答案: