Skip to main content

Adding Role-Based Access Control

In the previous tutorials, users could register, log in, access protected pages and log out. In this tutorial, you will add roles to your user accounts and restrict access to pages based on those roles.

The system will support three roles:

admin
teacher
student

Add a Role Column to the Users Table

Open phpMyAdmin and select your project_db database.

Run the following SQL statement:

ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';

This creates a new field called role and automatically assigns the value student to any existing or future users.

Check the Updated Table

Run:

SELECT * FROM users;

You should now see a role column.

Example:

user_id username password role
1 admin $2y$10$... student
2 teacher $2y$10$... student

Update Existing Users

Update the admin account:

UPDATE users
SET role = 'admin'
WHERE username = 'admin';

Update the teacher account:

UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';

Run:

SELECT * FROM users;

Example:

user_id username role
1 admin admin
2 teacher teacher
3 testuser student

Store the User Role in the Session

Open:

login.php

Locate:

$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];

Add:

$_SESSION["role"] = $user["role"];

The completed section should look like:

$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];

header("Location: members.php");
exit();

This stores the user's role when they log in.

Display the User Role

Open:

members.php

Add:

<p>Role:
<?php echo $_SESSION["role"]; ?>
</p>

Example:

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

<p>Role:
<?php echo $_SESSION["role"]; ?>
</p>

Save the file and log in.

Example result:

Welcome, admin

Role: admin

Create an Admin Page

Create a new file called:

admin.php

Add the following code:

<?php

session_start();

if (!isset($_SESSION["user_id"])) {

    header("Location: login.php");
    exit();

}

if ($_SESSION["role"] != "admin") {

    die("Access denied.");

}

?>

<!DOCTYPE html>
<html>
<head>
    <title>Admin Area</title>
</head>
<body>

<h1>Admin Area</h1>

<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>

</body>
</html>

Save the file.

Test Admin Access

Log in as:

admin

Visit:

http://localhost/admin.php

The page should load successfully.

Test Non-Admin Access

Log out.

Log in as:

teacher

or

student

Visit:

http://localhost/admin.php

You should see:

Access denied.

Open:

members.php

Add:

<?php if ($_SESSION["role"] == "admin") { ?>

<p>
    <a href="admin.php">Admin Area</a>
</p>

<?php } ?>

Example:

<p>
    <a href="logout.php">Logout</a>
</p>

<?php if ($_SESSION["role"] == "admin") { ?>

<p>
    <a href="admin.php">Admin Area</a>
</p>

<?php } ?>

Now only administrators will see the Admin Area link.

Complete SQL Commands

ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';

UPDATE users
SET role = 'admin'
WHERE username = 'admin';

UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';

SELECT * FROM users;

Complete Role Storage Code

$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];

header("Location: members.php");
exit();

You now have a role-based access system that supports:

  • Admin users
  • Teacher users
  • Student users

You can use the same technique to create protected pages for different user groups.

Next tutorial: Creating a Navigation Menu Based on User Roles.

Back to top