基于角色的登录在php中

Question

I have created a page in php which allows the users to update,create and delete the list. There are two types of users, admin and student. I want to allow the students only to view the list and allow the admin to perform other operation. I have created the table to view the actions. How can I separate it for different users? I cannot redirect the users based upon their role because user needs to click button to perform action.

    <?php
    include 'Database.php';
        $query=mysqli_query($con,"SELECT * FROM student");
        while ($res=mysqli_fetch_array($query)) {

            ?>
            <tr>
                <td><?php echo $res['id']; ?></td>
                <td><?php echo $res['Username']; ?></td>
                <td><?php echo $res['Email']; ?></td>
                <td><?php echo $res['Course']; ?></td>
                <td> <button class="w3-btn w3-red"> <a href="delete.php?id=<?php echo $res['id']; ?>"> Delete </a>  </button>
                 <button class="w3-btn w3-blue"> <a href="update.php?id=<?php echo $res['id']; ?>"> Update </a> </button> </td>
            </tr>
            <?php
        }
    ?>
</table>
</body>
</html>

Answer 1

Let's first create a table for users:

CREATE TABLE `users` (
  `ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT,
  `user_email` varchar(100) NOT NULL DEFAULT '',
  `user_pass` varchar(255) NOT NULL DEFAULT '',
  `user_role` ENUM('admin', 'student') NOT NULL DEFAULT `student`,
  `user_registered` datetime NULL DEFAULT NULL,
  `user_status` int(11) NOT NULL DEFAULT '0',
  PRIMARY KEY (`ID`),
  KEY `user_email` (`user_email`)
);

Then the login page:

if($_SERVER['REQUEST_METHOD'] == 'POST'){
    $email = $_POST['email'];
    $pass  = $_POST['pass'];

    ...

    // Save user into $_SESSION
    $_SESSION['user'] = $user;
}

View users page:

<tr>
    <td><?php echo $res['id']; ?></td>
    <td><?php echo $res['Username']; ?></td>
    <td><?php echo $res['Email']; ?></td>
    <td><?php echo $res['Course']; ?></td>
    <td>
    <?php if($_SESSION['user']['role'] == 'admin'): ?>
        <button class="w3-btn w3-red"><a href="delete.php?id=<?php echo $res['id']; ?>">Delete</a></button>
        <button class="w3-btn w3-blue"><a href="update.php?id=<?php echo $res['id']; ?>">Update</a></button>
    <?php elseif($_SESSION['user']['role'] == 'student'): ?>
        ...
    <?php endif; ?>
    </td>
</tr>

On update & delete page add this code:

if($_SESSION['user']['role'] != 'admin'){
    die("You're not allowed to do this action!");
}