PHP – Use Case 14: Implementing User Roles and Permissions in PHP

Project Overview

Implementing User Roles and Permissions is crucial for managing access control in web applications. This project covers creating different user roles (e.g., Admin, Editor, Subscriber), assigning permissions to these roles, and enforcing access control throughout the application using PHP and MySQL. It is essential for applications that require varying levels of user access and functionality.

Prerequisites

Ensure you have the following:

• Web Server: Apache (using XAMPP, WAMP, or MAMP)
• PHP: Version 7.4 or higher
• MySQL: For database management
• Code Editor: VS Code, Sublime Text, PHPStorm, etc.
• Composer: For dependency management (optional)
• Basic Understanding of Sessions, Forms, and Database Relationships in PHP

Step-by-Step Procedure

1. Setting Up the Development Environment

1. Install XAMPP:
   • Download from XAMPP Official Website.
   • Follow the installation wizard and install it in the default directory.
2. Start Apache and MySQL:
   • Open the XAMPP Control Panel.
   • Start the Apache and MySQL modules.
3. Install Composer (Optional):
   • If you plan to use PHP packages or libraries, install Composer from Composer Official Website.

2. Creating the Database

1. Access phpMyAdmin:
   • Navigate to http://localhost/phpmyadmin/ in your browser.
2. Create a New Database:
   • Click on “New” in the left sidebar.
   • Name the database user_roles_permissions.
   • Choose “utf8mb4_unicode_ci” as the collation.
   • Click “Create”.
3. Create Tables:
   • users Table: Field Type Null Key Default Extra id INT NO PRI NULL AUTO_INCREMENT username VARCHAR(50) NO UNI NULL email VARCHAR(100) NO UNI NULL password VARCHAR(255) NO NULL role_id INT NO MUL NULL created_at TIMESTAMP NO CURRENT_TIMESTAMP
   • roles Table: Field Type Null Key Default Extra id INT NO PRI NULL AUTO_INCREMENT name VARCHAR(50) NO UNI NULL created_at TIMESTAMP NO CURRENT_TIMESTAMP
   • permissions Table: Field Type Null Key Default Extra id INT NO PRI NULL AUTO_INCREMENT name VARCHAR(100) NO UNI NULL created_at TIMESTAMP NO CURRENT_TIMESTAMP
   • role_permissions Table: (Pivot table to establish many-to-many relationship between roles and permissions) Field Type Null Key Default Extra role_id INT NO MUL NULL permission_id INT NO MUL NULL
     • Composite Primary Key: (role_id, permission_id)
4. Establish Foreign Keys:
   • users.role_id references roles.id with ON DELETE CASCADE.
   • role_permissions.role_id references roles.id with ON DELETE CASCADE.
   • role_permissions.permission_id references permissions.id with ON DELETE CASCADE.

3. Project Structure

Organize your project files as follows:

user-roles-permissions/
├── vendor/             # Composer dependencies
├── assets/
│   ├── css/
│   │   └── styles.css
│   └── js/
│       └── scripts.js
├── config/
│   └── db.php
├── templates/
│   ├── header.php
│   └── footer.php
├── register.php
├── login.php
├── dashboard.php
├── manage_roles.php
├── manage_permissions.php
├── assign_permissions.php
├── README.md
└── composer.json

4. Configuration

a. Database Connection (config/db.php)

Create a file named db.php inside the config directory to handle database connections.

<?php
// config/db.php

$host = 'localhost';
$db   = 'user_roles_permissions';
$user = 'root'; // Default XAMPP MySQL user
$pass = '';     // Default XAMPP MySQL password is empty
$charset = 'utf8mb4';

$dsn = "mysql:host=$host;dbname=$db;charset=$charset";

$options = [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION, // Enable exceptions
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,       // Fetch associative arrays
    PDO::ATTR_EMULATE_PREPARES   => false,                  // Disable emulation
];

try {
    $pdo = new PDO($dsn, $user, $pass, $options);
} catch (\PDOException $e) {
    // Handle connection errors
    http_response_code(500);
    echo "Database connection failed.";
    exit;
}
?>

5. Creating Reusable Templates

a. Header (templates/header.php)

<?php
// templates/header.php
session_start();
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>User Roles and Permissions</title>
    <link rel="stylesheet" href="/user-roles-permissions/assets/css/styles.css">
</head>
<body>
    <header>
        <h1>User Roles and Permissions System</h1>
        <nav>
            <?php if (isset($_SESSION['user_id'])): ?>
                <a href="/user-roles-permissions/dashboard.php">Dashboard</a>
                <a href="/user-roles-permissions/manage_roles.php">Manage Roles</a>
                <a href="/user-roles-permissions/manage_permissions.php">Manage Permissions</a>
                <a href="/user-roles-permissions/logout.php">Logout (<?php echo htmlspecialchars($_SESSION['username']); ?>)</a>
            <?php else: ?>
                <a href="/user-roles-permissions/register.php">Register</a>
                <a href="/user-roles-permissions/login.php">Login</a>
            <?php endif; ?>
        </nav>
    </header>
    <main>

b. Footer (templates/footer.php)

<?php
// templates/footer.php
?>
    </main>
    <footer>
        <p>&copy; <?php echo date("Y"); ?> Your Company Name</p>
    </footer>
    <script src="/user-roles-permissions/assets/js/scripts.js"></script>
</body>
</html>

6. Styling the Application (assets/css/styles.css)

Add basic styles to enhance the appearance.

/* assets/css/styles.css */

body {
    font-family: Arial, sans-serif;
    margin: 0;
    padding: 0;
}

header, footer {
    background-color: #2c3e50;
    color: #ecf0f1;
    padding: 10px 20px;
}

header h1, footer p {
    margin: 0;
}

nav a {
    color: #ecf0f1;
    margin-right: 15px;
    text-decoration: none;
}

nav a:hover {
    text-decoration: underline;
}

main {
    padding: 20px;
}

form {
    max-width: 500px;
    margin: auto;
}

.form-group {
    margin-bottom: 15px;
}

label {
    display: block;
    margin-bottom: 5px;
}

input[type="text"],
input[type="email"],
input[type="password"],
select {
    width: 100%;
    padding: 8px;
    box-sizing: border-box;
}

button {
    padding: 10px 15px;
    background-color: #2980b9;
    color: #fff;
    border: none;
    cursor: pointer;
}

button:hover {
    background-color: #3498db;
}

table {
    width: 100%;
    border-collapse: collapse;
    margin-top: 20px;
}

table, th, td {
    border: 1px solid #bdc3c7;
}

th, td {
    padding: 12px;
    text-align: left;
}

th {
    background-color: #ecf0f1;
}

.error {
    background-color: #f8d7da;
    color: #842029;
    padding: 15px;
    margin-bottom: 20px;
    border: 1px solid #f5c2c7;
    border-radius: 4px;
}

.success {
    background-color: #d1e7dd;
    color: #0f5132;
    padding: 15px;
    margin-bottom: 20px;
    border: 1px solid #badbcc;
    border-radius: 4px;
}

7. User Registration (register.php)

This page allows new users to create an account.

<?php
// register.php

require 'config/db.php';
require 'templates/header.php';

$errors = [];
$success = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Sanitize and validate inputs
    $username = trim($_POST['username']);
    $email    = trim($_POST['email']);
    $password = trim($_POST['password']);
    $confirm_password = trim($_POST['confirm_password']);
    $role_id  = 3; // Default role: Subscriber

    if (empty($username)) {
        $errors[] = 'Username is required.';
    }

    if (empty($email)) {
        $errors[] = 'Email is required.';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $errors[] = 'Invalid email format.';
    }

    if (empty($password)) {
        $errors[] = 'Password is required.';
    } elseif (strlen($password) < 6) {
        $errors[] = 'Password must be at least 6 characters.';
    }

    if ($password !== $confirm_password) {
        $errors[] = 'Passwords do not match.';
    }

    // Check if username or email already exists
    if (empty($errors)) {
        $stmt = $pdo->prepare('SELECT id FROM users WHERE username = ? OR email = ?');
        $stmt->execute([$username, $email]);
        if ($stmt->fetch()) {
            $errors[] = 'Username or email already exists.';
        }
    }

    if (empty($errors)) {
        // Hash the password
        $hashed_password = password_hash($password, PASSWORD_DEFAULT);

        // Insert into database
        $stmt = $pdo->prepare('INSERT INTO users (username, email, password, role_id) VALUES (?, ?, ?, ?)');
        if ($stmt->execute([$username, $email, $hashed_password, $role_id])) {
            $success = 'Registration successful. You can now <a href="login.php">login</a>.';
            // Clear form fields
            $username = $email = $password = $confirm_password = '';
        } else {
            $errors[] = 'There was an error registering. Please try again.';
        }
    }
}
?>

<h2>Register</h2>

<?php if (!empty($errors)): ?>
    <div class="error">
        <ul>
            <?php foreach($errors as $error): ?>
                <li><?php echo htmlspecialchars($error); ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<?php if ($success): ?>
    <div class="success">
        <p><?php echo $success; ?></p>
    </div>
<?php endif; ?>

<form action="register.php" method="POST">
    <div class="form-group">
        <label for="username">Username:</label>
        <input type="text" id="username" name="username" value="<?php echo htmlspecialchars($username ?? ''); ?>" required>
    </div>

    <div class="form-group">
        <label for="email">Email:</label>
        <input type="email" id="email" name="email" value="<?php echo htmlspecialchars($email ?? ''); ?>" required>
    </div>

    <div class="form-group">
        <label for="password">Password (min 6 characters):</label>
        <input type="password" id="password" name="password" required>
    </div>

    <div class="form-group">
        <label for="confirm_password">Confirm Password:</label>
        <input type="password" id="confirm_password" name="confirm_password" required>
    </div>

    <button type="submit">Register</button>
</form>

<?php
require 'templates/footer.php';
?>

8. User Login (login.php)

This page allows existing users to log in. It includes role-based redirection.

<?php
// login.php

require 'config/db.php';
require 'templates/header.php';

$errors = [];
$success = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Sanitize and validate inputs
    $username = trim($_POST['username']);
    $password = trim($_POST['password']);

    if (empty($username)) {
        $errors[] = 'Username is required.';
    }

    if (empty($password)) {
        $errors[] = 'Password is required.';
    }

    if (empty($errors)) {
        // Fetch user from database
        $stmt = $pdo->prepare('SELECT users.id, users.username, users.password, roles.name AS role_name FROM users JOIN roles ON users.role_id = roles.id WHERE users.username = ?');
        $stmt->execute([$username]);
        $user = $stmt->fetch();

        if ($user && password_verify($password, $user['password'])) {
            // Password is correct, start a session
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['username'] = $user['username'];
            $_SESSION['role'] = $user['role_name'];
            // Redirect based on role
            if ($user['role_name'] === 'Admin') {
                header('Location: dashboard.php');
                exit;
            } elseif ($user['role_name'] === 'Editor') {
                header('Location: dashboard.php');
                exit;
            } else {
                header('Location: dashboard.php');
                exit;
            }
        } else {
            $errors[] = 'Invalid username or password.';
        }
    }
}
?>

<h2>Login</h2>

<?php if (!empty($errors)): ?>
    <div class="error">
        <ul>
            <?php foreach($errors as $error): ?>
                <li><?php echo htmlspecialchars($error); ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<?php if ($success): ?>
    <div class="success">
        <p><?php echo htmlspecialchars($success); ?></p>
    </div>
<?php endif; ?>

<form action="login.php" method="POST">
    <div class="form-group">
        <label for="username">Username:</label>
        <input type="text" id="username" name="username" value="<?php echo htmlspecialchars($username ?? ''); ?>" required>
    </div>

    <div class="form-group">
        <label for="password">Password:</label>
        <input type="password" id="password" name="password" required>
    </div>

    <button type="submit">Login</button>
</form>

<?php
require 'templates/footer.php';
?>

9. Dashboard (dashboard.php)

This is a protected page accessible only to authenticated users. Admins and Editors have access to manage roles and permissions.

<?php
// dashboard.php

require 'config/db.php';
require 'templates/header.php';

// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

// Fetch user information
$stmt = $pdo->prepare('SELECT users.username, roles.name AS role_name FROM users JOIN roles ON users.role_id = roles.id WHERE users.id = ?');
$stmt->execute([$_SESSION['user_id']]);
$user = $stmt->fetch();
?>

<h2>Welcome, <?php echo htmlspecialchars($user['username']); ?>!</h2>
<p>Your role: <strong><?php echo htmlspecialchars($user['role_name']); ?></strong></p>

<?php if ($user['role_name'] === 'Admin' || $user['role_name'] === 'Editor'): ?>
    <h3>Management Options</h3>
    <ul>
        <li><a href="manage_roles.php">Manage Roles</a></li>
        <li><a href="manage_permissions.php">Manage Permissions</a></li>
        <li><a href="assign_permissions.php">Assign Permissions to Roles</a></li>
    </ul>
<?php endif; ?>

<?php
require 'templates/footer.php';
?>

10. Managing Roles (manage_roles.php)

This page allows Admins to create, view, update, and delete user roles.

<?php
// manage_roles.php

require 'config/db.php';
require 'templates/header.php';

// Check if user is logged in and has Admin role
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'Admin') {
    echo "<p>You do not have permission to access this page.</p>";
    require 'templates/footer.php';
    exit;
}

$errors = [];
$success = '';

// Handle role creation
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_role'])) {
    $role_name = trim($_POST['role_name']);

    if (empty($role_name)) {
        $errors[] = 'Role name is required.';
    } else {
        // Insert into database
        $stmt = $pdo->prepare('INSERT INTO roles (name) VALUES (?)');
        try {
            $stmt->execute([$role_name]);
            $success = 'Role created successfully.';
        } catch (PDOException $e) {
            if ($e->getCode() == 23000) { // Integrity constraint violation
                $errors[] = 'Role name already exists.';
            } else {
                $errors[] = 'There was an error creating the role.';
            }
        }
    }
}

// Handle role deletion
if (isset($_GET['delete_role'])) {
    $delete_role_id = (int)$_GET['delete_role'];

    // Prevent deleting Admin role
    $stmt = $pdo->prepare('SELECT name FROM roles WHERE id = ?');
    $stmt->execute([$delete_role_id]);
    $role = $stmt->fetch();
    if ($role && $role['name'] === 'Admin') {
        $errors[] = 'Cannot delete Admin role.';
    } else {
        // Delete role
        $stmt = $pdo->prepare('DELETE FROM roles WHERE id = ?');
        $stmt->execute([$delete_role_id]);
        $success = 'Role deleted successfully.';
    }
}

// Fetch all roles
$stmt = $pdo->query('SELECT * FROM roles');
$roles = $stmt->fetchAll();
?>

<h2>Manage Roles</h2>

<?php if (!empty($errors)): ?>
    <div class="error">
        <ul>
            <?php foreach($errors as $error): ?>
                <li><?php echo htmlspecialchars($error); ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<?php if ($success): ?>
    <div class="success">
        <p><?php echo htmlspecialchars($success); ?></p>
    </div>
<?php endif; ?>

<h3>Create New Role</h3>
<form action="manage_roles.php" method="POST">
    <div class="form-group">
        <label for="role_name">Role Name:</label>
        <input type="text" id="role_name" name="role_name" required>
    </div>
    <button type="submit" name="create_role">Create Role</button>
</form>

<h3>Existing Roles</h3>
<table>
    <thead>
        <tr>
            <th>ID</th>
            <th>Role Name</th>
            <th>Actions</th>
        </tr>
    </thead>
    <tbody>
        <?php foreach ($roles as $role): ?>
            <tr>
                <td><?php echo htmlspecialchars($role['id']); ?></td>
                <td><?php echo htmlspecialchars($role['name']); ?></td>
                <td>
                    <?php if ($role['name'] !== 'Admin'): ?>
                        <a href="manage_roles.php?delete_role=<?php echo $role['id']; ?>" onclick="return confirm('Are you sure you want to delete this role?');">Delete</a>
                    <?php else: ?>
                        <!-- Admin role cannot be deleted -->
                        N/A
                    <?php endif; ?>
                </td>
            </tr>
        <?php endforeach; ?>
    </tbody>
</table>

<?php
require 'templates/footer.php';
?>

11. Managing Permissions (manage_permissions.php)

This page allows Admins to create, view, update, and delete permissions.

<?php
// manage_permissions.php

require 'config/db.php';
require 'templates/header.php';

// Check if user is logged in and has Admin role
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'Admin') {
    echo "<p>You do not have permission to access this page.</p>";
    require 'templates/footer.php';
    exit;
}

$errors = [];
$success = '';

// Handle permission creation
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['create_permission'])) {
    $permission_name = trim($_POST['permission_name']);

    if (empty($permission_name)) {
        $errors[] = 'Permission name is required.';
    } else {
        // Insert into database
        $stmt = $pdo->prepare('INSERT INTO permissions (name) VALUES (?)');
        try {
            $stmt->execute([$permission_name]);
            $success = 'Permission created successfully.';
        } catch (PDOException $e) {
            if ($e->getCode() == 23000) { // Integrity constraint violation
                $errors[] = 'Permission name already exists.';
            } else {
                $errors[] = 'There was an error creating the permission.';
            }
        }
    }
}

// Handle permission deletion
if (isset($_GET['delete_permission'])) {
    $delete_permission_id = (int)$_GET['delete_permission'];

    // Delete permission
    $stmt = $pdo->prepare('DELETE FROM permissions WHERE id = ?');
    $stmt->execute([$delete_permission_id]);
    $success = 'Permission deleted successfully.';
}

// Fetch all permissions
$stmt = $pdo->query('SELECT * FROM permissions');
$permissions = $stmt->fetchAll();
?>

<h2>Manage Permissions</h2>

<?php if (!empty($errors)): ?>
    <div class="error">
        <ul>
            <?php foreach($errors as $error): ?>
                <li><?php echo htmlspecialchars($error); ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<?php if ($success): ?>
    <div class="success">
        <p><?php echo htmlspecialchars($success); ?></p>
    </div>
<?php endif; ?>

<h3>Create New Permission</h3>
<form action="manage_permissions.php" method="POST">
    <div class="form-group">
        <label for="permission_name">Permission Name:</label>
        <input type="text" id="permission_name" name="permission_name" required>
    </div>
    <button type="submit" name="create_permission">Create Permission</button>
</form>

<h3>Existing Permissions</h3>
<table>
    <thead>
        <tr>
            <th>ID</th>
            <th>Permission Name</th>
            <th>Actions</th>
        </tr>
    </thead>
    <tbody>
        <?php foreach ($permissions as $permission): ?>
            <tr>
                <td><?php echo htmlspecialchars($permission['id']); ?></td>
                <td><?php echo htmlspecialchars($permission['name']); ?></td>
                <td>
                    <a href="manage_permissions.php?delete_permission=<?php echo $permission['id']; ?>" onclick="return confirm('Are you sure you want to delete this permission?');">Delete</a>
                </td>
            </tr>
        <?php endforeach; ?>
    </tbody>
</table>

<?php
require 'templates/footer.php';
?>

12. Assigning Permissions to Roles (assign_permissions.php)

This page allows Admins to assign or revoke permissions to different roles.

<?php
// assign_permissions.php

require 'config/db.php';
require 'templates/header.php';

// Check if user is logged in and has Admin role
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'Admin') {
    echo "<p>You do not have permission to access this page.</p>";
    require 'templates/footer.php';
    exit;
}

$errors = [];
$success = '';

// Fetch all roles and permissions
$stmt = $pdo->query('SELECT * FROM roles');
$roles = $stmt->fetchAll();

$stmt = $pdo->query('SELECT * FROM permissions');
$permissions = $stmt->fetchAll();

// Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['role_id'])) {
    $role_id = (int)$_POST['role_id'];
    $selected_permissions = isset($_POST['permissions']) ? $_POST['permissions'] : [];

    // Begin transaction
    $pdo->beginTransaction();

    try {
        // Delete existing permissions for the role
        $stmt = $pdo->prepare('DELETE FROM role_permissions WHERE role_id = ?');
        $stmt->execute([$role_id]);

        // Insert new permissions
        if (!empty($selected_permissions)) {
            $stmt = $pdo->prepare('INSERT INTO role_permissions (role_id, permission_id) VALUES (?, ?)');
            foreach ($selected_permissions as $permission_id) {
                $stmt->execute([$role_id, $permission_id]);
            }
        }

        // Commit transaction
        $pdo->commit();
        $success = 'Permissions updated successfully.';
    } catch (Exception $e) {
        // Rollback transaction
        $pdo->rollBack();
        $errors[] = 'There was an error assigning permissions.';
    }
}
?>

<h2>Assign Permissions to Roles</h2>

<?php if (!empty($errors)): ?>
    <div class="error">
        <ul>
            <?php foreach($errors as $error): ?>
                <li><?php echo htmlspecialchars($error); ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<?php if ($success): ?>
    <div class="success">
        <p><?php echo htmlspecialchars($success); ?></p>
    </div>
<?php endif; ?>

<form action="assign_permissions.php" method="POST">
    <div class="form-group">
        <label for="role_id">Select Role:</label>
        <select id="role_id" name="role_id" required onchange="this.form.submit()">
            <option value="">--Select Role--</option>
            <?php foreach ($roles as $role): ?>
                <option value="<?php echo $role['id']; ?>" <?php if (isset($_POST['role_id']) && $_POST['role_id'] == $role['id']) echo 'selected'; ?>>
                    <?php echo htmlspecialchars($role['name']); ?>
                </option>
            <?php endforeach; ?>
        </select>
    </div>

    <?php
    // If a role is selected, display permissions
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['role_id'])) {
        $role_id = (int)$_POST['role_id'];

        // Fetch permissions assigned to the role
        $stmt = $pdo->prepare('SELECT permission_id FROM role_permissions WHERE role_id = ?');
        $stmt->execute([$role_id]);
        $assigned_permissions = $stmt->fetchAll(PDO::FETCH_COLUMN);

        echo '<div class="form-group">';
        echo '<label>Assign Permissions:</label><br>';
        foreach ($permissions as $permission) {
            $checked = in_array($permission['id'], $assigned_permissions) ? 'checked' : '';
            echo '<input type="checkbox" name="permissions[]" value="' . $permission['id'] . '" ' . $checked . '> ' . htmlspecialchars($permission['name']) . '<br>';
        }
        echo '</div>';
        echo '<button type="submit">Update Permissions</button>';
    }
    ?>

</form>

<?php
require 'templates/footer.php';
?>

13. Logging Out Users (logout.php)

This script logs users out by destroying their session.

<?php
// logout.php

session_start();
session_unset();
session_destroy();

// Redirect to login page
header('Location: login.php');
exit;
?>

14. Testing the Application

1. Set Up Roles and Permissions:
   • Default Roles: Insert default roles such as Admin, Editor, and Subscriber into the roles table via phpMyAdmin or directly through manage_roles.php.
   • Default Permissions: Insert permissions like create_post, edit_post, delete_post, manage_users, etc., into the permissions table via phpMyAdmin or manage_permissions.php.
2. Register a New User:
   • Navigate to http://localhost/user-roles-permissions/register.php.
   • Fill in the registration form and submit.
   • Ensure that the user is created with the default role (e.g., Subscriber).
3. Login as Admin:
   • Ensure that at least one user has the Admin role.
   • Navigate to http://localhost/user-roles-permissions/login.php.
   • Enter Admin credentials and log in.
   • Verify access to dashboard.php, manage_roles.php, manage_permissions.php, and assign_permissions.php.
4. Assign Permissions:
   • While logged in as Admin, navigate to assign_permissions.php.
   • Select a role (e.g., Editor) and assign appropriate permissions.
   • Submit and verify that permissions are updated successfully.
5. Role-Based Access Control:
   • Log in with users of different roles and attempt to access restricted pages.
   • Ensure that only users with the appropriate roles can access or perform certain actions.
6. Manage Roles and Permissions:
   • Test creating, updating, and deleting roles and permissions via manage_roles.php and manage_permissions.php.
   • Ensure that critical roles like Admin cannot be deleted.
7. Handle Edge Cases:
   • Attempt to assign non-existent permissions to roles.
   • Ensure that the application handles such scenarios gracefully without breaking.

15. Deployment Considerations

When deploying your User Roles and Permissions system to a live server, consider the following:

• Secure Session Handling:
  • Use secure session cookies (session.cookie_secure and session.cookie_httponly) to protect session data.
• Input Validation and Sanitization:
  • Thoroughly validate and sanitize all user inputs to prevent SQL injection and XSS attacks.
• Use HTTPS:
  • Implement HTTPS to ensure secure data transmission, especially for login and management functionalities.
• Role Hierarchies:
  • Consider implementing role hierarchies if your application requires more complex access control.
• Audit Trails:
  • Maintain logs of role and permission changes for security auditing and accountability.
• Error Handling:
  • Provide user-friendly error messages without exposing sensitive information.
• Regular Backups:
  • Schedule regular backups of your database to prevent data loss.
• Scalability:
  • Design your roles and permissions system to accommodate future expansion and additional roles or permissions.

16. Enhancements and Best Practices

• Granular Permissions:
  • Implement more granular permissions to allow for detailed access control.
• Permission Groups:
  • Group related permissions to simplify management and assignment.
• User Interface Enhancements:
  • Improve the UI/UX of management pages with better layouts, search functionality, and filtering options.
• Dynamic Role Creation:
  • Allow dynamic creation of roles with customizable permission sets via the admin interface.
• Middleware for Access Control:
  • Implement middleware or utility functions to check permissions before accessing protected pages or performing actions.
• Role Inheritance:
  • Implement role inheritance to allow roles to inherit permissions from other roles, reducing redundancy.
• API Integration:
  • Expose role and permission data via a RESTful API for integration with other services or frontend frameworks.
• Regular Security Audits:
  • Conduct regular security audits to ensure that access controls are functioning correctly and that there are no vulnerabilities.