# Adding Role-Based Access Control
In the previous tutorials, users could register, log in, access protected pages and log out. In this tutorial, you will add roles to your user accounts and restrict access to pages based on those roles.
The system will support three roles:
```text
admin
teacher
student
```
---
## Add a Role Column to the Users Table
Open phpMyAdmin and select your `project_db` database.
Run the following SQL statement:
```sql
ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';
```
This creates a new field called `role` and automatically assigns the value `student` to any existing or future users.
## Check the Updated Table
Run:
```sql
SELECT * FROM users;
```
You should now see a role column.
Example:
| user_id | username | password | role |
| ------- | -------- | ---------- | ------- |
| 1 | admin | $2y$10$... | student |
| 2 | teacher | $2y$10$... | student |
## Update Existing Users
Update the admin account:
```sql
UPDATE users
SET role = 'admin'
WHERE username = 'admin';
```
Update the teacher account:
```sql
UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';
```
Run:
```sql
SELECT * FROM users;
```
Example:
| user_id | username | role |
| ------- | -------- | ------- |
| 1 | admin | admin |
| 2 | teacher | teacher |
| 3 | testuser | student |
[](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780909123223.png)
## Store the User Role in the Session
Open:
```text
login.php
```
Locate:
```php
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
```
Add:
```php
$_SESSION["role"] = $user["role"];
```
The completed section should look like:
```php
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];
header("Location: members.php");
exit();
```
This stores the user's role when they log in.
---
## Display the User Role
Open:
```text
members.php
```
Add:
```php
Role:
```
Example:
```php
Welcome,
Role:
```
Save the file and log in.
Example result:
```text
Welcome, admin
Role: admin
```
## Create an Admin Page
Create a new file called:
```text
admin.php
```
Add the following code:
```php
Admin Area
Admin Area
Welcome,
```
Save the file.
---
## Test Admin Access
Log in as:
```text
admin
```
Visit:
```text
http://localhost/admin.php
```
The page should load successfully.
## Test Non-Admin Access
Log out.
Log in as:
```text
teacher
```
or
```text
student
```
Visit:
```text
http://localhost/admin.php
```
You should see:
```text
Access denied.
```
## Add an Admin Link
Open:
```text
members.php
```
Add:
```php
Admin Area
```
Example:
```php
Logout
Admin Area
```
Now only administrators will see the Admin Area link.
---
## Complete SQL Commands
```sql
ALTER TABLE users
ADD role VARCHAR(20) NOT NULL DEFAULT 'student';
UPDATE users
SET role = 'admin'
WHERE username = 'admin';
UPDATE users
SET role = 'teacher'
WHERE username = 'teacher';
SELECT * FROM users;
```
---
## Complete Role Storage Code
```php
$_SESSION["user_id"] = $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];
header("Location: members.php");
exit();
```
You now have a role-based access system that supports:
* Admin users
* Teacher users
* Student users
You can use the same technique to create protected pages for different user groups.
Next tutorial: **Creating a Navigation Menu Based on User Roles**.