Question

I have been using PHP and JavaScript for building my dad’s website. He wants to incorporate a login system into his website, and I have the design for the system using PHP. My problem is how do I show buttons if the person is logged in?­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­

For Example – You have Home, Products, About Us, and Contact. I want to have buttons for Dealer, Distributor, and maybe other information if the user is logged in. So I will have Home, Products, About Us, Contacts, Dealer (if dealer login), Distributor (if distributor login), and so forth.

Would JavaScript be a good way to do this or would PHP, or maybe even both? Using JavaScript to show and hide buttons, and PHP to check to see which buttons to show. ­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­

Answer 1

Regarding security, you cannot trust what comes from the client:

• The visitor can see all your code (HTML and Javascript, not PHP) and try stuff
• The visitor may not even use a browser; it’s trivially easy to send a request with a script

This means hiding the buttons is good User Interface design (because you can’t use them if you are not logged in). But it’s not a security feature. The security feature is checking, on the server, that the visitor is logged in before each action that requires it.

If you don’t intend to show the buttons, it’s not useful to send the HTML and images to the browser and then hide them with Javascript. I would check with PHP.