PHP session validation

Question

I want to write a script that can only be accessed by an administrator.

This is how I want to do it:

session_start();

if (!isset($_SESSION['user_id'])) { //not logged in

    //redirect to homepage
    header("Location: http://domain.com/index.php");
    die();

}

if ($_SESSION['user_level'] != 1337) { //not admin

    //redirect to homepage
    header("Location: http://domain.com/index.php");
    die();

}

if ($_SERVER['REQUEST_METHOD'] == 'POST') { //form is submitted

    //validate the submitted data
    //submit the query

}

//form goes here

My question is: Is there a better way of validating this (eg. should all three conditionals be nested) or is this enough?

Cheers,

n1te

you can use IF ELSEIF ELSE it is more suitable for the situation. — devasia2112
– devasia2112, Commented Oct 30, 2012 at 12:00

Vyktor · Accepted Answer · 2012-10-30 12:03:04Z

4

If it's not possible that persons rights will change on the fly (namely: you remove admins right), then this should be enough, although I'd build a function:

function IsAdmin() {
    if( !isset($_SESSION['user_level'])){
        return false;
    }

    return ($_SESSION['user_level'] == 1337);
}

For the case you'll use extended rights checking in future.

answered Oct 30, 2012 at 12:03

Vyktor

21.1k6 gold badges69 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Chris · Accepted Answer · 2012-10-30 12:01:39Z

1

The following is a little tidier... though you may want to run some validation on $_SESSION['user_id'] to ensure that it is an int or whatever datatype you are expecting...

session_start();

if (!isset($_SESSION['user_id']) || $_SESSION['user_level'] != 1337) { //not logged in

    //redirect to homepage
    header("Location: http://domain.com/index.php");
    exit(); // NOT DIE :P

}


if ($_SERVER['REQUEST_METHOD'] == 'POST') { //form is submitted

    //validate the submitted data
    //submit the query

}

//form goes here

answered Oct 30, 2012 at 12:01

Chris

5,6151 gold badge28 silver badges31 bronze badges

1 Comment

Chris Over a year ago

use 'is_numeric' maybe to validate the $_SESSION['user_id'] after verifying that it existes, else you will get an unidentified index error

Brian · Accepted Answer · 2012-10-30 12:02:24Z

0

I'd write:

if (!isset($_SESSION['user_id']) || $_SESSION['user_level'] != 1337) {
    //not logged in/not admin
    //redirect to homepage
    header("Location: http://domain.com/index.php");
    die();
}

answered Oct 30, 2012 at 12:02

Brian

8,6212 gold badges27 silver badges32 bronze badges

Collectives™ on Stack Overflow

PHP session validation

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related