Question

Suppose I am building an app using current mysql database tables.

I have this query (SELECT o.,u. FROM users u JOIN orders o ON (o.order_id = u.user_id) WHERE o.order_id = ?) to set privileges.

Answer 1

You just need to add something to the WHERE clause in view_order.php that matches the user_id of the logged in user to the order – that will let a user just see their own orders. If you want to give admins the ability to see, everything:

SELECT 
o.*,u.* 
FROM 
users u JOIN orders o ON (o.user_id = u.user_id) 
WHERE 
o.order_id = ? AND (o.user_id=? OR u.privileges='ADMIN')

At least something like that – you’ll have to tweak it slightly, as I’ve no idea how your tracking the details of the logged in user.