How can I hide certain webpages or links from certain users? - php

Question

My tool uses:
PHP for scripting.
mySQL for DB.
Apache for host.
There will be 2 groups of users.
I want to give access to 1 group of users only for 2 webpages.
The other group of users will have the access for all the pages and links.
Is there a way I can hide certain links on a webpage from a certain group of users, too.
How can I achieve this.
Fairly new to programming.
Any help will be greatly appreciated.
Thank you.

Answer 1

Lets say, Admin & normal user.... in that case we will have a column in the user table which will store he/she is admin or not. When you do authentication, fetch this value & keep it in SESSION. So in every page you check this person is admin or not with that session value using if clause.

Answer 2

It's hard to give any fitting exmaples without code, but if you have a MySQL and know some PHP, the basic way of solving this problem would be connecting to the database, checking what group the currently logged in user is (check by ID or however you set things up) and wrapping if statements around the links you want to hide from certain people that check if they belong to the right group to see said pages. You can also hide the pages from them by just putting a check whether they can see the page content or not on top of the content and throwing some sort of no permission error when needed. For this basic example hard-coding the groups into the files should be sufficient. If you plan on expanding all this later on, I'd maybe make a seperate table in your database controlling page view permissions.
You can also include HTML code in your PHP if statements by just closing the PHP section after the if (?>) and put the closing bracket of the if at the end of your HTML menu for the secret group (<?php } ?>).
If you provide us with some code snippets, we can maybe help you a bit more with examples.

Answer 3

There are many ways you could achieve this.
How to 'hide' the page
A good way to really hide the pages would be to check the type of user before displaying anything. If the type of user has access to the requested page, display it. If the user does not have access, you could send a 404 page not found error.
This way, user which does not have access to the page wont even know the page exist even if they have the URL.
Authenticate the user
As mentioned by Akhil Sidharth, you can use a $_SESSION variable to keep the type of the user trying to view the pages.

Answer 4

Every application now a days is using group, permission and capabilities to restrict site/application users from accessing the page/content/link within the site/application. Sometime group might be refereed as role to organize users. Let me describe -
Group/Role - Role might be - Admin, Manager, Employee, Customer etc. Your application should have role management system where you can manage(add/edit/delete) the roles/user-groups. These roles should be stored in DB tables.
Permission - Permission might be Allow, Deny, Restrict etc.
Capabilities - Capabilities might define the list of works/actions/activities that a user can take on your site or on a particular page. Some examples are - a. Can View XY*Z link b. Can View X*B page c. Can create user d. Can assign permission e. Can change permission etc.
Apart from this, your application should have two addtional management page -:
Configure capabilities & permission for the said roles, where you can configure and set capabilities either 'Allow'/'Deny' for the roles.
Role to users - This is the page where you can put the users into a particular role.
In this way you have the idea, what a particular users have rights/permissions to do on the site & restrict the users over accessing the contents/pages/links accordingly.
Alternatively, the simplest way for you now is to add a 'type' field in your user DB table. Add a drop down of users types where you are creating/updating the user & save the user type in your user db table. Restrict the user on the basis of user type accordingly.