Admin Levels/User Role implementation in PHP/SQL

Question

I am trying to implement a Admin Level/User role into my website, I am fairly new to PHP so still trying to figure a few things out.

I have this SQL query:

$sqlUserLevel = $user_home->runQuery("SELECT * FROM po_users");
$sqlUserLevel->execute();
$loggedInUserRole = $sqlUserLevel->fetch(PDO::FETCH_ASSOC);

and this PHP if statement:

if($loggedInUserRole['userRole'] == "Admin"){
    include 'file.php';
  }else{
  //dont show.
}

But the content is still showing to everyone not just "Admin" users can someone point me in the right direction...

please note that youre fetching all the rows from your users table — user6612690
– user6612690, Commented Nov 16, 2016 at 9:01
AS the above comments suggests, you need a where clause $sqlUserLevel = $user_home->runQuery("SELECT * FROM po_users WHERE user_id = $currentUserID"); — p3tch
– p3tch, Commented Nov 16, 2016 at 9:12

Pranav MS · Accepted Answer · 2016-11-16 09:21:52Z

1

I think your query may be wrong , My opinion is please try to select the user role from op_user rather than * . What happens here you first record always looking and the if condition never gonna true. so that's why you getting this issue . Please have a try. This may help you.

Please change this as what you want.

 $sqlUserLevel = $user_home->runQuery("SELECT userRole FROM po_users where uid='".$myUid."'");
    $sqlUserLevel->execute();
    $loggedInUserRole = $sqlUserLevel->fetch(PDO::FETCH_ASSOC);


    if($loggedInUserRole['userRole'] == "Admin"){
        include 'file.php';
      }else{
      //dont show.
    }

Please have a try this may help you.

edited Nov 16, 2016 at 9:21

answered Nov 16, 2016 at 9:04

Pranav MS

2,3212 gold badges26 silver badges57 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

junkfoodjunkie Over a year ago

But please do not use that query. There should never be a variable directly in a query (good rule of thumb). Granted, if the variable is pulled directly from other hardcoded values, or taken directly from another query, it might be okay, but as a general rule, always use prepared queries.

Collectives™ on Stack Overflow

Admin Levels/User Role implementation in PHP/SQL

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related