With the popularity of Internet applications, we hope to protect data within the application to ensure that sensitive data is not misused or stolen. One of the solutions is to use role-based access control (RBAC).

Role-based access control (RBAC) is an access control model based on the relationship between users and roles. The core idea of ??this model is to link the user's role to the access control operation, rather than linking the access control operation directly to the user. This approach increases the flexibility of access control and enables administrators to more easily manage users.

In this article, we will use PHP and RBAC to implement a basic user access control system. Here are the tables we will use:

• users: Used to store information about registered users.
• roles: Used to store role-centric access permission lists.
• user_roles: used to store the roles to which the user belongs.
• permissions: used to store permission lists and access control lists.
• role_permissions: used to store the list of permissions owned by the role.

We will use the following steps to implement our RBAC control system:

Step 1: Create a database and establish the tables related to it

In the MySQL database Create a new database and set up the following 4 tables:

CREATE TABLE users (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    email VARCHAR(100) NOT NULL UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE roles (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE user_roles (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    user_id INT(11) NOT NULL,
    role_id INT(11) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY user_id_fk (user_id) REFERENCES users(id),
    FOREIGN KEY role_id_fk (role_id) REFERENCES roles(id)
);

CREATE TABLE permissions (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) UNIQUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE role_permissions (
    id INT(11) NOT NULL AUTO_INCREMENT PRIMARY KEY,
    role_id INT(11) NOT NULL,
    permission_id INT(11) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY role_id_fk (role_id) REFERENCES roles(id),
    FOREIGN KEY permission_id_fk (permission_id) REFERENCES permissions(id)
);

Step 2: Write PHP code

We will implement a basic PHP class to handle our RBAC control system. This class will allow us to add users, add roles, add permissions, assign users to roles and assign permissions to roles.

class Rbac {

  // 數(shù)據(jù)庫連接和表名
  private $conn;
  private $users_table = "users";
  private $roles_table = "roles";
  private $user_roles_table = "user_roles";
  private $permissions_table = "permissions";
  private $role_permissions_table = "role_permissions";

  // 構(gòu)造函數(shù)將數(shù)據(jù)庫連接
  public function __construct($db) {
    $this->conn = $db;
  }

  // 添加用戶
  public function addUser($username, $password, $email) {
    // 生成密碼哈希
    $password_hash = password_hash($password, PASSWORD_BCRYPT);
    // 插入用戶到數(shù)據(jù)庫
    $query = "INSERT INTO " . $this->users_table . "(username, password, email) VALUES (:username, :password, :email)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":username", $username);
    $stmt->bindParam(":password", $password_hash);
    $stmt->bindParam(":email", $email);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 添加角色
  public function addRole($name) {
    $query = "INSERT INTO " . $this->roles_table . "(name) VALUES (:name)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":name", $name);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 添加權(quán)限
  public function addPermission($name) {
    $query = "INSERT INTO " . $this->permissions_table . "(name) VALUES (:name)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":name", $name);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 將用戶分配給角色
  public function assignUserRole($user_id, $role_id) {
    $query = "INSERT INTO " . $this->user_roles_table . "(user_id, role_id) VALUES (:user_id, :role_id)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":user_id", $user_id);
    $stmt->bindParam(":role_id", $role_id);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

  // 將權(quán)限分配給角色
  public function assignRolePermission($role_id, $permission_id) {
    $query = "INSERT INTO " . $this->role_permissions_table . "(role_id, permission_id) VALUES (:role_id, :permission_id)";
    $stmt = $this->conn->prepare($query);
    $stmt->bindParam(":role_id", $role_id);
    $stmt->bindParam(":permission_id", $permission_id);
    if($stmt->execute()) {
      return true;
    } else {
      return false;
    }
  }

}

We now have a simple class that can add users, add roles, add permissions, assign users to roles and assign permissions to roles.

Step 3: Test

We can now create a test script to test our RBAC control system. The following is the sample code:

// 包括我們的RBAC類
include_once 'Rbac.php';

// 設(shè)置數(shù)據(jù)庫連接
$database = new PDO("mysql:host=localhost;dbname=testdb", "username", "password");

// 定義RBAC類
$rbac = new Rbac($database);

// 添加用戶
$rbac->addUser("user1", "password1", "user1@example.com");
$rbac->addUser("user2", "password2", "user2@example.com");

// 添加角色
$rbac->addRole("admin");
$rbac->addRole("editor");
$rbac->addRole("user");

// 添加權(quán)限
$rbac->addPermission("create");
$rbac->addPermission("read");
$rbac->addPermission("update");
$rbac->addPermission("delete");

// 將用戶分配給角色
$rbac->assignUserRole(1, 1); // user1 is assigned the admin role
$rbac->assignUserRole(1, 3); // user1 is also assigned the user role
$rbac->assignUserRole(2, 2); // user2 is assigned the editor role

// 將權(quán)限分配給角色
$rbac->assignRolePermission(1, 1); // admin role is assigned the create permission
$rbac->assignRolePermission(1, 2); // admin role is assigned the read permission
$rbac->assignRolePermission(1, 3); // admin role is assigned the update permission
$rbac->assignRolePermission(1, 4); // admin role is assigned the delete permission
$rbac->assignRolePermission(3, 2); // user role is assigned the read permission

// 提示測試完成
echo "Test complete!";

The above test script will execute our RBAC control system and will add a user, 3 different roles, 4 different permissions, then assign the user to the role, and assign the permissions assigned to each role.

Conclusion

In this article, we have learned how to implement role-based access control using PHP and RBAC. We have built a simple RBAC control system that can add users, add roles, add permissions, assign users to roles and assign permissions to roles. In practical applications, the RBAC control system can be more routine and complex, which requires us to expand and improve it according to the actual situation.

The above is the detailed content of Implementing Role-Based Access Control (RBAC): Using PHP and RBAC. For more information, please follow other related articles on the PHP Chinese website!