PHP を使用してユーザー権限管理を実装する方法

CREATE TABLE `users` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(50) NOT NULL,
  `password` varchar(255) NOT NULL,
  PRIMARY KEY (`id`)
);

CREATE TABLE `permissions` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `permission` varchar(50) NOT NULL,
  PRIMARY KEY (`id`)
);

CREATE TABLE `user_permissions` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `user_id` int(11) NOT NULL,
  `permission_id` int(11) NOT NULL,
  PRIMARY KEY (`id`)
);

<?php
session_start();

// 数据库连接信息
$servername = "localhost";
$username = "root";
$password = "password";
$dbname = "mydb";

$con = mysqli_connect($servername, $username, $password, $dbname);

// 获取登录表单提交的用户名和密码
$username = $_POST["username"];
$password = $_POST["password"];

// 验证用户名和密码
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($con, $sql);
$row = mysqli_fetch_assoc($result);

if ($row) {
  // 用户登录成功，保存用户信息到 session
  $_SESSION["user_id"] = $row["id"];
} else {
  // 用户名或密码错误，返回登录页面或给出错误提示
}
?>

<?php
session_start();

// 验证用户是否登录
if (!isset($_SESSION["user_id"])) {
  // 如果用户未登录，根据需求，可以重定向到登录页面或给出错误提示
}

// 获取用户的权限列表
$user_id = $_SESSION["user_id"];
$sql = "SELECT permissions.permission FROM user_permissions INNER JOIN permissions ON user_permissions.permission_id = permissions.id WHERE user_permissions.user_id = $user_id";
$result = mysqli_query($con, $sql);

$permissions = array();
while ($row = mysqli_fetch_assoc($result)) {
  $permissions[] = $row["permission"];
}

// 验证用户是否有指定权限
function hasPermission($permission) {
  global $permissions;
  return in_array($permission, $permissions);
}
?>

<?php
require_once "auth.php";

// 验证用户是否有编辑文章的权限
if (hasPermission("edit_article")) {
  // 显示编辑文章的按钮
}
?>