phprocker Posted October 30, 2010 Share Posted October 30, 2010 Hey all. I have a script that checks if a user is an admin and then allows that person to change certain page layouts and other things. My question is, of the following 2 examples, which is best way to check if the user is an admin. 1st example: Should I have just a session that is set if the user is an admin and then have the pages displayed if he/she is? or 2nd example: Should I have each and every single admin query/request check if the user is an admin or not? What's the proper method? Cheers! Quote Link to comment Share on other sites More sharing options...
Eiolon Posted October 30, 2010 Share Posted October 30, 2010 To make things simple, many people will create an admin area to do all the major administration tasks. One each page, when checking for the session, also check to see if the user has admin status. It would be unwise to allow regular users to see admin tools and functions, only to have them be denied access when executing the script. Just deny them access altogether by not letting them see the admin features in the first place. Quote Link to comment Share on other sites More sharing options...
BlueSkyIS Posted October 30, 2010 Share Posted October 30, 2010 I prefer the first option. When admin logs in, a session variable is set to indicate that the user is 1. logged in and 2. an admin. Quote Link to comment Share on other sites More sharing options...
phprocker Posted October 30, 2010 Author Share Posted October 30, 2010 Got it, thanks. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.