如何防止PHP网页中的非法访问？

Question

I have a problem regarding access in my web pages. In log in it can already distinguish if the user is admin or not. admin has different page with ordinary.

my problem is if the user change the address in the address bar for example:

home.php -> ordinary user
home_admin.php -> administrator 

Ordinary can also access the home_admin.php if the user change the address in the address bar. All my pages are using sessions.

any suggestion how can I solve my problem.

TIA

Answer 1

You have to save the current state of access rights in your session. After that you can make a condition and if he has not enough rights to retrieve the content of the page, redirect him to another site.

Like this example

<?php

if($_SESSION['user_role'] !== 'administrator') {
   // redirect him
}

?>