Mit første forsøg på sådan et system her (består af mange filer):
connect.php, ret "HOST", "USER", "PASSWORD" og "DB" til din egen db.
<?php
$mysql = mysql_connect("HOST", "USER", "PASSWORD");
mysql_select_db("DB", $mysql);
if (mysql_errno()) {
printf("Connect failed: %s\n", mysql__error());
exit();
}
?>
user_system.php
<?php
class UserSystem{
private static $error = array(0);
const NONE = 0;
const PRIVELEGE_1 = 1;
const PRIVELEGE_2 = 2;
const PRIVELEGE_3 = 4;
const PRIVELEGE_4 = 8;
const PRIVELEGE_5 = 16;
const PRIVELEGE_6 = 32;
const PRIVELEGE_7 = 64;
const PRIVELEGE_8 = 128;
public static function is_logged_in(){
return isset($_SESSION['userid']);
}
public static function has_priveleges($priveleges){
if(!self::is_logged_in()){
return $priveleges == self::NONE;
}
return ($priveleges & $_SESSION['priveleges']) == $priveleges;
}
public static function make_access_level(){
$priveleges = self::NONE;
foreach(func_get_args() as $arg){
$priveleges |= $arg;
}
return $priveleges;
}
private static function input_check_login($login){
if(empty($login)){
self::$error = array(2, "Login empty");
return false;
}
return true;
}
private static function input_check_password($password){
if(empty($password)){
self::$error = array(3, "Password empty");
return false;
}
return true;
}
private static function input_check_privelege($privelege){
if(empty($privelege)){
self::$error = array(4, "Privelege empty");
return false;
}
if(!is_numeric($privelege)){
self::$error = array(4, "Priveleges must be between 0 - 255");
return false;
}
if($privelege < 0 || $privelege > 255){
self::$error = array(4, "Priveleges must be between 0 - 255");
return false;
}
return true;
}
public static function login($login, $password, $mysql){
if(!self::input_check_login($login)){
return false;
}
if(!self::input_check_password($password)){
return false;
}
$login = "'" . mysql_real_escape_string($login) . "'";
$password = "'" . md5(mysql_real_escape_string($password)) . "'";
$res = mysql_query('SELECT `id`, `priveleges` FROM `user` WHERE `login` = ' . $login . ' AND `password` = ' . $password, $mysql);
$e = mysql_errno($mysql);
if($e){
self::$error = array(1, $e, mysql_error($mysql));
return false;
}
print mysql_numrows($res);
if(mysql_numrows($res) == 0){
self::$error = array(5, "No user");
return false;
}
list($userid, $priveleges) = mysql_fetch_row($res);
$_SESSION['userid'] = $userid;
$_SESSION['priveleges'] = $priveleges;
return true;
}
public static function get_error(){
return self::$error;
}
public static function clear_error(){
self::$error = array(0);
}
public static function create_user($login, $password, $priveleges, $mysql){
self::clear_error();
if(!self::input_check_login($login)){
return false;
}
if(!self::input_check_password($password)){
return false;
}
if(!self::input_check_privelege($priveleges)){
return false;
}
$login = "'" . mysql_real_escape_string($login) . "'";
$password = "'" . md5(mysql_real_escape_string($password)) . "'";
$priveleges = "'" . mysql_real_escape_string($priveleges) . "'";
mysql_query('INSERT INTO `user`(`login`,`password`,`priveleges`)
VALUES(' . $login . ',' . $password . ',' .$priveleges . ')', $mysql);
$e = mysql_errno($mysql);
if($e){
self::$error = array(1, $e, mysql_error($mysql));
return false;
}
return true;
}
}
?>
priveleges.php, denne fil er teknisk set ikke nødvendigt, men den gør livet lettere. Den sætter nogle af rettighederne til navngivet rettigheder og opretter bruger rettigheder der samler de navngivet. Her vist for et forum.
<?php
$make_edit_delete_own_posts_threads = UserSystem::PRIVELEGE_1;
$ban_users = UserSystem::PRIVELEGE_2;
$delete_edit_sticky_other_posts = UserSystem::PRIVELEGE_3;
$make_forums = UserSystem::PRIVELEGE_7;
$change_priveleges = UserSystem::PRIVELEGE_8;
$common_user = UserSystem::make_access_level(
$make_edit_delete_own_posts_threads
);
$moderator_user = UserSystem::make_access_level(
$make_edit_delete_own_posts_threads
,$ban_users
,$delete_edit_sticky_other_posts
);
$admin_user = UserSystem::make_access_level(
$make_edit_delete_own_posts_threads
,$ban_users
,$delete_edit_sticky_other_posts
,UserSystem::PRIVELEGE_4
,UserSystem::PRIVELEGE_5
,UserSystem::PRIVELEGE_6
,$make_forums
,$change_priveleges
);
?>
install.php, denne fil opretter tabellen i databasen. Upload den, afvikle den og fjern den fra serveren igen.
Opret bruger:
<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);
include "connect.php";
mysql_query('
CREATE TABLE IF NOT EXISTS `user` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`login` varchar(20) NOT NULL,
`password` varchar(32) NOT NULL,
`priveleges` tinyint(3) unsigned NOT NULL,
PRIMARY KEY (`id`),
KEY `login` (`login`,`password`)
)
');
if (mysql_errno()) {
printf("Connect failed: %s\n", mysql_error());
exit();
}
?>
Det følgende viser koden til oprette en bruger:
<?php
include_once 'connect.php';
include_once 'user_system.php';
include_once 'priveleges.php';
if(!UserSystem::create_user('kaj','password', $common_user, $mysql)){
$e = UserSystem::get_error();
print ('Error id '.$e[0]);
//print ('Error id '.$e[0].' '.(($e[0]==1)?$e[1]:''));
//print ('Error id '.$e[0].' message '.(($e[0]==1)?$e[2]:$e[1]));
}
?>
Du kan selv sætte koden ind i en fil med form osv. Husk at rette kaj og password til værdier fra formen, $common_user er fra priveleges.php filen.
Det følgende viser koden til logind:
<?php
include_once 'connect.php';
include_once 'user_system.php';
if(!UserSystem::login('kurt', 'password', $mysql)){
$e = UserSystem::get_error();
print ('Error id '.$e[0]);
//print ('Error id '.$e[0].' '.(($e[0]==1)?$e[1]:''));
//print ('Error id '.$e[0].' message '.(($e[0]==1)?$e[2]:$e[1]));
}
?>
Det følgende viser koden til at teste om en bruge er logget ind:
<?php
include_once 'connect.php';
include_once 'user_system.php';
if(UserSystem::is_logged_in()){
print('Is logged in<br>');
}else{
print('Is not logged in<br>');
}
?>
Det følgende viser koden til at teste om en bruger har rettigheder:
<?php
include_once 'connect.php';
include_once 'user_system.php';
include_once 'priveleges.php';
//tester om du er admin
if(UserSystem::has_priveleges($admin_user)){
print('True');
}else{
print('False');
}
//tester om du har ret til at banne brugere
if(UserSystem::has_priveleges($ban_users)){
print('True');
}else{
print('False');
}
?>