phprocker Posted October 30, 2010 Share Posted October 30, 2010 Hey all. I have a script that checks if a user is an admin and then allows that person to change certain page layouts and other things. My question is, of the following 2 examples, which is best way to check if the user is an admin. 1st example: Should I have just a session that is set if the user is an admin and then have the pages displayed if he/she is? or 2nd example: Should I have each and every single admin query/request check if the user is an admin or not? What's the proper method? Cheers! Link to comment https://forums.phpfreaks.com/topic/217320-whats-best-way-to-do-this/ Share on other sites More sharing options...
Eiolon Posted October 30, 2010 Share Posted October 30, 2010 To make things simple, many people will create an admin area to do all the major administration tasks. One each page, when checking for the session, also check to see if the user has admin status. It would be unwise to allow regular users to see admin tools and functions, only to have them be denied access when executing the script. Just deny them access altogether by not letting them see the admin features in the first place. Link to comment https://forums.phpfreaks.com/topic/217320-whats-best-way-to-do-this/#findComment-1128471 Share on other sites More sharing options...
BlueSkyIS Posted October 30, 2010 Share Posted October 30, 2010 I prefer the first option. When admin logs in, a session variable is set to indicate that the user is 1. logged in and 2. an admin. Link to comment https://forums.phpfreaks.com/topic/217320-whats-best-way-to-do-this/#findComment-1128472 Share on other sites More sharing options...
phprocker Posted October 30, 2010 Author Share Posted October 30, 2010 Got it, thanks. Link to comment https://forums.phpfreaks.com/topic/217320-whats-best-way-to-do-this/#findComment-1128502 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.