PHP account privilege , session or mysql check

Question

For a user with moderator privileges; When the user logs in do i query to check the user is a moderator, then set a session? So on pages with moderator options , for example

if($_SESSION['mod']==1) {
//moderator options
}

Alternatively do i put a query on everypage and check if the user is flagged as a moderator? Then for moderator options, for example

if($moderatorfound==1) {
//moderator options
}

Below, I currently set the username as a moderator in a cookie but as i am learning about PHP security this is unsafe;

    if($moderator=='1') {
    setcookie('username[3]',$moderator,time()+(60*60*24*365));  
    }

 if($_COOKIE['username'][3]==1) {
    //moderator options
    }

What is the secure way to do this? Example would help.

EyalAr · Accepted Answer · 2012-07-01 08:53:13Z

1

Once the user logs in, store his information in session variables.
No need to check with the database on every page.
A cookie is not a good solution to hold sensitive information (such as privileges), since it might be altered by the user.

answered Jul 1, 2012 at 8:53

EyalAr

3,1801 gold badge24 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user892134 Over a year ago

so i would just do $_SESSION['moderator']=1; when logged in? Is that secure enough?

EyalAr Over a year ago

it depends by what you mean in "enough", but yes - generally it suffices.

Nick Maroulis · Accepted Answer · 2012-07-01 08:53:37Z

0

In the cookie, set a complex code and save that in a database. If the complex code matches that of the username allow access.

answered Jul 1, 2012 at 8:53

Nick Maroulis

48710 silver badges29 bronze badges

Collectives™ on Stack Overflow

PHP account privilege , session or mysql check

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related