检查用户权限

Question

I want to check a user if they have permission to view the site during the login process via a manual set value in MySQL.

How would I insert that check into this code:

include 'dbh.inc.php';

$uid = mysqli_real_escape_string($conn, $_POST['uid']);
$pwd = mysqli_real_escape_string($conn, $_POST['pwd']);

//Error handlers
//check if inputs are empty
if (empty($uid) || empty($pwd)) {
    header("Location: ../index.php?login=empty");
    exit();
} else {
    $sql = "SELECT * FROM users WHERE user_uid='$uid' OR user_email='$uid'";
    $result = mysqli_query($conn, $sql);
    $resultCheck = mysqli_num_rows($result);
    if ($resultCheck < 1) {
        header("Location: ../index.php?login=error");
        exit();
    } else {
        if ($row = mysqli_fetch_assoc($result)) {
            //de-hash pass
            $hashedPwdCheck = password_verify($pwd, $row['user_pwd']);
            if ($hashedPwdCheck == false) {
                header("Location: ../index.php?login=error");
                exit();
            } elseif ($hashedPwdCheck == true) {
                //log in user here
                $_SESSION['u_id'] = $row['user_id'];
                $_SESSION['u_first'] = $row['user_first'];
                $_SESSION['u_last'] = $row['user_last'];
                $_SESSION['u_email'] = $row['user_email'];
                $_SESSION['u_uid'] = $row['user_uid'];
                header("Location: ../index.php?login=success");
                exit();
            }
        }
    }
}

Answer 1

You have pretty much everything done already. But your question not clear enough. Do you want to block the user from login or only allow limited access to certain pages for the user ?

if ($hashedPwdCheck == false) {
 header("Location: ../index.php?login=error");
 exit();
} elseif ($hashedPwdCheck == true) {
 if($row['user_can_login']){ 
  //log in user here
  $_SESSION['u_id'] = $row['user_id'];
  $_SESSION['u_first'] = $row['user_first'];
  $_SESSION['u_last'] = $row['user_last'];
  $_SESSION['u_email'] = $row['user_email'];
  $_SESSION['u_uid'] = $row['user_uid'];
  header("Location: ../index.php?login=success");
  exit();
 }else{
  header("Location: ../index.php?login=error");
  exit();
 }
}

This is to block existing user from login.