User-levels

[bo0]

I am creating a sort of "user-level" script for my site.

Currently I am using the set of functions below to determine what level a user is. Is there an easier more robust way of doing this?

  function isadmin($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='10'"));
	return $anz;
}

  function issupermod($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='7'"));
	return $anz;
}

  function ismoderator($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='6'"));
	return $anz;
}

  function istechsupport($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='5'"));
	return $anz;
}

  function isvip($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='4'"));
	return $anz;
}

  function isbeta($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='3'"));
	return $anz;
}

  function isgold($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='2'"));
	return $anz;
}

  function isuser($userID) {
    $anz=mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='1'"));
	return $anz;
}

[thorpe]

I would be more inclined to wrap that all into one function or something, but its more personal preference I suppose.

function islevel($uid,$level) {
  return mysql_num_rows(safe_query("SELECT userid FROM users WHERE userid='$userID' AND level='$level'"));
}

Then... to use it, first define some constants to make it more readable.

define("ADMIN",10);
define("SUPERMOD",7);
define("MODERATOR",6);
// etc etc....
if (islevel(3,ADMIN)) {
  // perform an admin only task.
} else {
  echo "sorry, you need to be of level admin to perform this task";
}

Just another way of doing it I guess.

[Shrike]

The common thing to do is when the user logs in to select their access level and put it in the login session. Then check if the user has the required level before allowing them to perform the restricted actions.

Following Thorpe's comment - putting the access level in the session saves hitting the database 😉

[konrad]

You should avoid building too many queries. It's much more faster to get all necessary records in one query. Below is slightly better solution.

 function checkUserLevel($userID){
  $uLevel[$userID] = array('isAdmin' => false, 'isSuperMod' => false, 'isModerator' => false /*... */); 
  $res = safe_query('SELECT level FROM users WHERE userid="'.$userID.'";');
  if( mysql_num_rows($res) ){
   while( $row = mysql_fetch_array($res) ){
    switch( $row['level'] ){
     case 10:
      $uLevel['isAdmin'] = true;
      break;

 case 7:
  $uLevel['isSuperMod'] = true;
  break;

 case 6:
  $uLevel['isModerator'] = true;
  break;

/* define all necessary user levels
 .
 .
 .
   */
   }
  }
 }
 return $uLevel[$userID];
}

/*
.
.
.
*/

/* to check user level just create global array containing all levels for a user */
$userIDArray = checkUserLevel('someUserId');

/* check if someUserId is admin*/
if( $userIDArray['isAdmin'] ){
 echo 'ADMIN';
}
else{
 echo 'someUser is not an ADMIN!';
}