多用户权限网站安全实现咨询：单/多PHP文件方案是否合规？

Great questions—let's break this down clearly since you're already on the right track moving away from frontend-only permission control (which is indeed a big security risk).

方案1：多文件权限页面的可行性 #

Your first approach is technically correct and secure—here's why:

• Sensitive content is never sent to unauthorized users, which fixes the core issue with your original display:none method.
• The session-based checks on each page prevent direct access (e.g., someone typing index_boss.php into the address bar without proper permissions gets redirected).

That said, there are a few caveats to make this robust:

• Always validate that the session exists first: Your example code assumes $_SESSION['loggedin'] and $_SESSION['authority'] are set, but if a user hasn't logged in, these variables will be undefined. Add checks like isset($_SESSION['loggedin']) to avoid errors or unintended behavior.
• Hardening your sessions: Make sure to set session.cookie_httponly = true and session.cookie_secure = true (if using HTTPS) in your php.ini to prevent XSS attacks from stealing session IDs.
• Maintenance overhead: With 5 pages × 3 permission levels = 15 files, updating shared content (like headers, footers, or navigation) will require editing every file. This gets tedious quickly as your site grows.

方案2：单个PHP文件的权限控制方法 #

Absolutely—this is the better approach for maintainability while keeping things secure. Here's how to implement it:

The core idea is to have a single main file that handles permission checks, then loads/renders content based on the user's authority level. You can split content into reusable include files to keep your code clean.

Example Implementation #

<?php
session_start();

// First, enforce login
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
    header("Location: login.php");
    exit; // Always exit after a header redirect to stop code execution
}

// Define permission constants for readability (optional but recommended)
define('AUTH_CUSTOMER', 0);
define('AUTH_EMPLOYEE', 1);
define('AUTH_BOSS', 2);

// Get user authority, default to customer if undefined
$user_auth = $_SESSION['authority'] ?? AUTH_CUSTOMER;
?>
<!DOCTYPE html>
<html>
<head>
    <!-- Shared header content (CSS, meta tags, etc.) -->
    <title>My Site</title>
    <link rel="stylesheet" href="styles.css">
</head>
<body>
    <!-- Shared navigation (shows links based on permission) -->
    <nav>
        <a href="index.php">Home</a>
        <?php if ($user_auth >= AUTH_EMPLOYEE): ?>
            <a href="employee_tasks.php">My Tasks</a>
        <?php endif; ?>
        <?php if ($user_auth >= AUTH_BOSS): ?>
            <a href="analytics.php">Company Analytics</a>
        <?php endif; ?>
        <a href="logout.php">Logout</a>
    </nav>

    <!-- Permission-specific content -->
    <main>
        <?php if ($user_auth === AUTH_CUSTOMER): ?>
            <h1>Welcome, Customer!</h1>
            <?php include 'customer_content.php'; // Load customer-specific content ?>
        <?php elseif ($user_auth === AUTH_EMPLOYEE): ?>
            <h1>Employee Dashboard</h1>
            <?php include 'employee_content.php'; // Load employee-specific content ?>
        <?php elseif ($user_auth === AUTH_BOSS): ?>
            <h1>Admin Dashboard</h1>
            <?php include 'boss_content.php'; // Load boss-specific content ?>
        <?php else: ?>
            <p>Error: Invalid permission level. Please contact support.</p>
        <?php endif; ?>
    </main>

    <!-- Shared footer -->
    <footer>© 2024 My Site</footer>
</body>
</html>

Additional Best Practices #

• Centralize permission checks: Create a reusable function (e.g., checkPermission($required_level)) in a shared file like functions.php, then include that file in every protected page. This avoids repeating validation code.
• Use prepared statements: When fetching user permissions from MySQL, always use prepared statements to prevent SQL injection (you probably know this, but it's worth emphasizing!).
• Limit session duration: Set a reasonable session timeout (via session.gc_maxlifetime in php.ini) to reduce the risk of stolen sessions being misused.

内容的提问来源于stack exchange，提问作者captain monk