这个PHP登录部分安全吗？

Question

I´m just trying to learn something of php and I have two questions. I want to make user roles based system, for the begining I just simply added a role for each user (admin, user, etc.), which is saved directly in users table in mysql? I mean my user table has columns id, nick, password, role. Is this OK, or even safe?

Second question is if it is safe to check user permisions like

// Check if the user is logged in, if not then redirect him to login page
if(!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true){
    header("location: login.php");
    exit;
}
// Check if the user has admin role, if not then load up page which tells u - You dont have perm to use this site
elseif($_SESSION["role"] !== "admin"){
    include "noperm.php";
    exit;
}

Can I do this, or there's still possibility that role user, or ununregistered user can access this page (e.c. user management site)?

</div>

Answer 1

Yes and no, for example when a user login in a php website, the username and password or whatever credential who him use will be sended open, or encrypted in a websites with md5 sha-2 and other algorithms, in short answer if the algorithm( encryption ) is weak the decryption will be easy for a attacker, and the user will be hacked, and is much more big the risk when is a connection with HTTP protocol, because HTTP is completely open compared to HTTPS, because HTTPS use a certificate with the client and the website, and all information is sended with a double encryption, encryption1 the algorithm of the php, encryption2 the certificate SSL, but includes the SSL Certificate can be spoofed if a organization produce a certificate similar with the same domain of the website attacked.

NOTE: The reallity is, It depend of how much the person secure the web site, and how much strong make the client the password...

CREATE YOU OWN ALGORITHM:

<?php
    // ENCRYPTION //
    $passwordOfTheUSER = "JonnyDeep74";
    $encryptedPassword = str_replace('o', 'UXK', $passwordOfTheUSER);
    $encryptedPassword = str_replace('a', 'PEA', $encryptedPassword);
    $encryptedPassword = str_replace('e', 'MIC', $encryptedPassword);
    echo "encrypted: $encryptedPassword, ";

    // DECRYPTION //
    $decryptedPassword = str_replace('UXK', 'o', $encryptedPassword);
    $decryptedPassword = str_replace('PEA', 'a', $decryptedPassword);
    $decryptedPassword = str_replace('MIC', 'e', $decryptedPassword);
    echo "decrypted: $decryptedPassword.";
?>