Question

I’ve read quite a few posts that are very similar to the question I’m about to ask, but I just wanted to be sure that there wasn’t a more sophisticated way to do this. Any feedback is greatly appreciated.

I want to create a mechanism to check whether or not a logged-in user has access to the php script that is currently being called. If so, the script will continue on; if not, the script just fails out using something like die('you have no access').

I came up with two ways of accomplishing this:

(please assume my session stuff is coded/working fine – i.e. I call session_start(), set up the session vars properly and etc)

1. Define a global variable first, then check the global variable in a required header file. For example:

   Content of current_executing_script.php:

   // the role the logged in user must have to continue on   
   $roleNeedToAccessThisFile = 'r';
   require 'checkRole.php''
   

   Content of checkRole.php:

   if ($_SESSION['user_role'] != $roleNeedToAccessThisFile) die('no access for you');
   

2. Define a function within the header file and call the function immediately after including/requiring it:

   Content of checkRole.php:

   function checkRole($roleTheUserNeedsToAccessTheFile) {
       return ($_SESSION['user_role'] == $roleTheUserNeedsToAccessTheFile);
   }

   Content of current_executing_script.php:

   require 'checkRole.php';
   checkRole('r') or die('no access for you');

I’m wondering if there is a way to basically just pass a parameter to checkRole.php as part of the include or require construct?

Thanks in advance.

Answer 1

There isn’t a way to pass parameters to include or require.

However the code that is included joins the program flow at the point where you include it, so it will inherit any variables that are in scope. So for example if you set $myflag=true immediately before the include, your included code will be able to check what $myflag is set to.

That said, I wouldn’t suggest using that technique. Far better for your include file to contain functions (or a class) rather than code that gets run straight off. If you’ve included a file containing functions then you can call your functions with whatever parameters you want at any point in your program. It’s much more flexible, and generally a better programming technique.

Hope that helps.