database design for a CMS system

[cbassett03]

Got a question regarding user profiles in CMS systems... I'm looking to build a custom home-made CMS system for myself (my website) but want to be able to add users and have various privilage levels (such as Admin, Moderator, General User, and guest).  Now, since each level will have different access to the MySQL database (such as Admin will have full access, Moderator will be able to add/remove records, but not modify database structure, General User will be able to post to certain areas of the database, but not alter other people's submissions, and a guest will only be able to read the database), is it best to handle the security via PHP code, or should I allow the system to create a user with appropriate privilages directly on the MySQL database server?

 

I'm thinking that writing the security system myself is more work, but might be the better way.  How is this generally handled in other CMS systems?

 

Basically, I want to know if I should have the system add users to the MySQL server, or should i embed the security in the PHP scripts themselves (for example, to check to see if a person is am admin--which would be able to make modifications--versus a guest--who will not be able to make any modifications to the database).

[trq]

Most web applications use one authenticated user only to connect to there databases.

[ignace]

I'm looking to build a custom home-made CMS system for myself (my website) but want to be able to add users and have various privilage levels (such as Admin, Moderator, General User, and guest).

 

YAGNI (You Ain't Gonna Need It)

 

Now, since each level will have different access to the MySQL database ... such as Admin will have full access

 

Bad idea. Just imagine someone hacks your account! Your application should suffice with one MySQL account with GRANTS on SELECT and INSERT. Not DELETE or UPDATE. You use a CMS for Content Management, if you DELETE it you can no longer manage it. Instead introduce archiving which is what businesses do once the data no longer serves any purpose to the company (but it may in the future) either on paper in some storage room or on digital format (CD, DVD, ..) or both. You also don't need UPDATE as CMS systems tend to version data. Look into version-control and check-in/out.

 

CMS systems can become really complex depending on the business that needs them as almost each company has different business rules for content management. So while you are making your home-grown CMS system KEEP IT SHORT AND SIMPLE (KISS)