Implementing a user level access in my site? - php

Question

I need to know how can I implement a user level access in my site. I need to hide forms and images when users with level are member...
in my DB I have a USERS TABLE with:
id
nombre
apellido
username
password
level
level is ENUM and have this two selects: administrator and member
I can hide scripts in any page with this type of PHP code:
<?php if(basename($_SERVER['PHP_SELF']) == 'contact.php') { ?>
<script src="js/jquery.js"></script>
<?php } ?>
and works very well, but I don't know how can hide per example this:
<div class="box span6">
<div class="box-header well" data-original-title>
<h2><i class="icon-picture"></i> <?php $translate->__('Save images'); ?></h2>
<div class="box-icon">
<i class="icon-chevron-up"></i>
<i class="icon-remove"></i>
</div>
</div>
<div class="box-content">
<form action="upload.php" method="post" name="image_upload" id="image_upload" enctype="multipart/form-data">
<label><?php $translate->__('Images type'); ?> (gif, jpg, png)</label><br />
<input type="file" size="45" name="uploadfile" id="uploadfile" class="file margin_5_0" onchange="ajaxUpload(this.form);" />
<div id="upload_area" class="corners align_center">
<?php $translate->__('Please select one image'); ?>.
</div>
</form>
</div>
</div>
In google I saw this code but don't work in my partycular case:
<?php if($USERS->level == "administrator"): ?>
<?php endif; ?>
can you help me with my problem?

Answer 1

Hiding js files will not do you much good because an attacker can intercept the javascript file being served to your admin user, build his own mock-up page of your site and have it use that javascript. So make sure to put security and validation in your php code, especially inside your upload.php
Obviously this $USERS->level can be replaced by any variable that you have set.
<?php if($USERS->level == "administrator")
{
?>
<div class="box span6">
<div class="box-header well" data-original-title>
<h2><i class="icon-picture"></i> <?php $translate->__('Save images'); ?></h2>
<div class="box-icon">
<i class="icon-chevron-up"></i>
<i class="icon-remove"></i>
</div>
</div>
<div class="box-content">
<form action="upload.php" method="post" name="image_upload" id="image_upload" enctype="multipart/form-data">
<label><?php $translate->__('Images type'); ?> (gif, jpg, png)</label><br />
<input type="file" size="45" name="uploadfile" id="uploadfile" class="file margin_5_0" onchange="ajaxUpload(this.form);" />
<div id="upload_area" class="corners align_center">
<?php $translate->__('Please select one image'); ?>.
</div>
</form>
</div>
</div>
<?php
}
?>