Securing Your PHP Application: A Comprehensive Tutorial on User Access Restriction

Submitted by oretnom23 on Monday, December 4, 2023 - 10:59.

Discover in this guide how to effectively control User Access Restrictions within a web application using the PHP programming language. This tutorial serves as a valuable resource for students and beginners in PHP, offering insights and techniques for developing web applications. Follow the outlined steps to implement user access restrictions, ensuring that certain pages or features of your PHP project are accessible only to authorized users.

What is the importance of implementing User Access Restrictions in a web application?

Enforcing user access restrictions in a web application is essential for various reasons, with a primary focus on enhancing security, safeguarding privacy, and ensuring a regulated user experience.

Learn the necessary steps to implement User Access Restriction:

Step 1: Incorporate User Role Identification in the Database

Initiate the process by adding a column to your user table in the database, housing the user's role value. This new column plays a crucial role in swiftly identifying and determining the role of the logged-in user.

Illustrated below is an example of the user table structure in MySQL:

    CREATE TABLE `users` (
        `id` int(11) AUTO_INCREMENT NOT NULL,
        `name` text NOT NULL,
        `username` text NOT NULL,
        `password` text NOT NULL,
        `user_type` varchar(20) NOT NULL,
        `created_at` datetime NOT NULL DEFAULT current_timestamp(),
        `updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp()
      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

Step 2: Make sure that User Role is included in Session

Next, You will need to make sure that you have included the user's role on the stored session of your web application. Here's an example of this step:

<?php
if($_SERVER['REQUEST_METHOD'] == "POST"){
    $login = $actionClass->login();
    if(!empty($login)){
        foreach($login as $meta_field => $meta_value){
            if($meta_field == 'password')
                continue;
            $_SESSION[$meta_field] = $meta_value;
        }
        echo "<script>location.replace('./');</script>";
        exit;
    }else{
        $_SESSION['flashdata'] = [
            'type' => "danger",
            'msg' => 'Incorrect username or password'
        ];
        $err = true;
    }
}
?>

Step 3: Develop a Function for Access Restriction Checking

Subsequently, craft a new PHP function containing the logic to assess whether the current logged-in user has the authorization to access specific pages or features within the application or system. Embed this function across all pages or action scripts where user access needs to be restricted. Below is an example snippet of the function within a class:

<?php 
class SampleClass{
    /**
    * Check Permission
    */
    public function check_restriction($role=""){
        if(!empty($role) && isset($_SESSION['user_type'])){
            if($role == $_SESSION['user_type'])
                return true;
        }
        return false;
    }
}
?>

On the desired page that requires security or limitation, implement the following:

<?php 
require_once("SampleClass.php");
$SampleClass = new SampleCLass();
if(!$SampleClass->check_restriction('admin')){
    echo "<script>alert('You are not allowed to access this page!');location.replace('./')</script>";
    exit;
}
?>

There you have it! Those are the straightforward steps to implement user access restrictions in a PHP-based web application. I've also developed a sample web application featuring login functionality, CRUD operations, and user access restriction to illustrate the steps outlined in this tutorial. You can download the complete source code zip file from this website, available for free. Look for the download button below the tutorial content.

The sample web application encompasses the following features:

Login and Logout
Product Management
- List All Products
- Add New Product
- Update Product Details
- Delete Product (Admin only)
User Management (Admin only)
- List All Users
- Add New User
- Update User Details
- Delete User

Snapshots

Explore some snapshots of the application:

Login Page

Product Page

User Page

Sample Restriction Message

Feel free to download and customize the source code to elevate your programming skills and knowledge.

For further insights into securing your web application projects, check out these additional articles:

Explore more on this website for more Tutorials, Free Source Codes, and Articles covering varios programming languages.