Adding Role-Based Access Control
In the previous tutorials, users could register, log in, access protected pages and log out. In this tutorial, you will add roles to your user accounts and restrict access to pages based on those roles.
The system will support three roles:
admin
teacher
student
Add a Role Column to the Users Table
Open phpMyAdmin and select your project_db database.
Run the following SQL statement:
ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';
This creates a new field called role and automatically assigns the value student to any existing or future users.
Check the Updated Table
Run:
SELECT * FROM users;
You should now see a role column.
Example:
| user_id | username | password | role |
|---|---|---|---|
| 1 | admin | $2y$10$... | student |
| 2 | teacher | $2y$10$... | student |
Update Existing Users
Update the admin account:
UPDATE users
SET role = 'admin'
WHERE username = 'admin';
Update the teacher account:
UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';
Run:
SELECT * FROM users;
Example:
| user_id | username | role |
|---|---|---|
| 1 | admin | admin |
| 2 | teacher | teacher |
| 3 | testuser | student |
Store the User Role in the Session
Open:
login.php
Locate:
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
Add:
$_SESSION["role"] = $user["role"];
The completed section should look like:
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];
header("Location: members.php");
exit();
This stores the user's role when they log in.
Display the User Role
Open:
members.php
Add:
<p>Role:
<?php echo $_SESSION["role"]; ?>
</p>
Example:
<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>
<p>Role:
<?php echo $_SESSION["role"]; ?>
</p>
Save the file and log in.
Example result:
Welcome, admin
Role: admin
Create an Admin Page
Create a new file called:
admin.php
Add the following code:
<?php
session_start();
if (!isset($_SESSION["user_id"])) {
header("Location: login.php");
exit();
}
if ($_SESSION["role"] != "admin") {
die("Access denied.");
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Admin Area</title>
</head>
<body>
<h1>Admin Area</h1>
<p>Welcome,
<?php echo $_SESSION["username"]; ?>
</p>
</body>
</html>
Save the file.
Test Admin Access
Log in as:
admin
Visit:
http://localhost/admin.php
The page should load successfully.
Test Non-Admin Access
Log out.
Log in as:
teacher
or
student
Visit:
http://localhost/admin.php
You should see:
Access denied.
Add an Admin Link
Open:
members.php
Add:
<?php if ($_SESSION["role"] == "admin") { ?>
<p>
<a href="admin.php">Admin Area</a>
</p>
<?php } ?>
Example:
<p>
<a href="logout.php">Logout</a>
</p>
<?php if ($_SESSION["role"] == "admin") { ?>
<p>
<a href="admin.php">Admin Area</a>
</p>
<?php } ?>
Now only administrators will see the Admin Area link.
Complete SQL Commands
ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';
UPDATE users
SET role = 'admin'
WHERE username = 'admin';
UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';
SELECT * FROM users;
Complete Role Storage Code
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];
header("Location: members.php");
exit();
You now have a role-based access system that supports:
- Admin users
- Teacher users
- Student users
You can use the same technique to create protected pages for different user groups.
Next tutorial: Creating a Navigation Menu Based on User Roles.