隐藏基于用户角色的菜单选项。 不是WP

Question

I have searched for this but all I can find is an answer if the site is wordpress.

I have 2 roles of users. Admin and SuperAdmin. In my database I have them as roles 1 & 2. I want to hide a menu item based on the role of the user.

LoginForm to check user input

$query = mysql_query("select * from members where password='$mypassword' AND username='$myusername' AND role='$role'", $connection);
  $rows = mysql_num_rows($query);
    if ($rows == 1) {
     $_SESSION['login_user'] = $myusername; // Initializing Session
     $token = md5(uniqid());
     $_SESSION['token'] = $token;
     $_SESSION['role'] = $role;
     $query = mysql_query("update token from members where username='$myusername' set token = '$token'", $connection);

Here is what I have after the member is logged in.

<?php
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] == true);
// User still logged
   $role = $row['role'];
   if ($_GET['role'] == '2') {
       $showdiv = 'super';
    }
    else if ($_GET['role'] == '1') {
       $showdiv = 'admin';
    }
    echo "<script type=\"text/javascript\">document.getElementById('".$showdiv."').style.display = 'block';</script>";
?>

Then I have this where the menus are. (Only the supernavbar is showing)

<div class="mainbar">
  <div id="super">
     <?php include("supernavbar.php"); ?>
    </div>
  <div id="admin">
     <?php include("navbar.php"); ?>
  </div>
</div> <!-- /.mainbar -->

I might have found the solution here (thanks to "related questions") Loading role-based navigation upon login

But my question on that, would I get the "role" from the login or on the 2nd page when they are logged in?

Answer 1

It's been three years since this question was asked but I will still try to answer.

You need to have a Role table and then Permissions table. Another table say Role_Permissions where you define which role has what permissions. Then when a user logs in you can check their role against what permissions they have and display proper menu items.

E.g. Your role table might look like this:

Admin
Manager
Sales

Then in permissions you can have:

Create_Order
Read_Order
Update_Order
Delete_Order

etc...

Then in the Role_permissions:

Admin Create_Order 1
Manager Create_Order 1
Sales Create_Order 0

you get the idea.