Admin roles in admin panel – PHP & MySQL
Let’s say you have an admin panel of your website where you can manage your website’s data. Now you want to have a functionality where you can create sub-admins with access to limited features. For example, one admin can manage posts (add, edit and delete), another admin can manage customers, another admin can manage employees and so on. And they all will be managed by super admin. So we need to assign different admin roles to each admin.
In this article, we will be creating a sub admin to manage posts.
Create database table
Create a table for admins where we will have a column named “roles”, it’s type will be ENUM so you can specify the roles. No roles other than specified in ENUM will be accepted.
CREATE TABLE `admins` (
`id` int(11) NOT NULL PRIMARY KEY AUTO_INCREMENT,
`email` text NOT NULL,
`password` text NOT NULL,
`role` enum('all','manage_posts') NOT NULL
);
CREATE TABLE `posts` (
`id` int(11) NOT NULL PRIMARY KEY AUTO_INCREMENT,
`title` text NOT NULL,
`created_by` int(11) NOT NULL,
CONSTRAINT `fk_created_by_posts` FOREIGN KEY (`created_by`) REFERENCES `admins` (`id`) ON UPDATE CASCADE ON DELETE CASCADE
);
Insert data in MySQL database
Super admin will be created manually and for once only. Give the role “all” to super admin:
INSERT INTO `admins` (`id`, `email`, `password`, `role`) VALUES
(1, 'admin@gmail.com', '$2y$10$e0qHrQw8irU1TPxjzfB2OOAQ/uUH/xq5jAP58f796jMAOLwEv2d9i', 'all')
Admin login form
You can generate password hash from here. First we will create a login form for all admins:
<?php
// start session and connect with database
session_start();
$conn = mysqli_connect("localhost", "root", "root", "tutorials");
?>
<!-- check if admin is logged in -->
<?php if (isset($_SESSION["admin"])): ?>
<!-- button to logout -->
<p>
<a href="?logout">Logout</a>
</p>
<?php else: ?>
<!-- form to login -->
<form method="POST">
<p>
<input type="email" name="email" placeholder="Enter email" required>
</p>
<p>
<input type="password" name="password" placeholder="Enter password" required>
</p>
<p>
<input type="submit" name="login" value="Login">
</p>
</form>
<?php endif; ?>
This will show a button to logout if the admin is logged in and a login form if an admin is not logged in.
Log in the admin and start his session
Now we will write the code to login the admin and start his session:
// check if request is for login
if (isset($_POST["login"]))
{
// get email and password
$email = $_POST["email"];
$password = $_POST["password"];
// check if email exists
$result = mysqli_query($conn, "SELECT * FROM admins WHERE email = '" . $email . "'");
if (mysqli_num_rows($result) > 0)
{
// check if password is correct
$admin = mysqli_fetch_object($result);
if (password_verify($password, $admin->password))
{
// start session
$_SESSION["admin"] = $admin;
echo "<p>Logged in.</p>";
}
else
{
echo "<p>Wrong password.</p>";
}
}
else
{
echo "<p>Email not found.</p>";
}
}
This will first check if the email exists in the database. Then it will compare the hashed password with plain text from input field. If credentials are okay then it will save the admin object in session variable.
Logout admin
Now you will see the logout button.
// check if request is for logout
if (isset($_GET["logout"]))
{
// remove from session and redirect back
unset($_SESSION["admin"]);
header("Location: " . $_SERVER["HTTP_REFERER"]);
}
When the logout button is clicked, we will remove this admin object from session variable and redirect the admin to the page where he came from. There are other methods to redirect the user to previous page and you will check those methods from here.
Add sub-admin form
Now if the logged-in admin is super admin then we will show him a form to add a new admin:
<!-- check if main admin -->
<?php if ($_SESSION["admin"]->role == "all"): ?>
<!-- add admin form -->
<h1>Add admin</h1>
<form method="POST">
<p>
<input type="email" name="email" placeholder="Enter email" required>
</p>
<p>
<input type="password" name="password" placeholder="Enter password" required>
</p>
<p>
<label>Enter role</label>
<select name="role" required>
<option value="all">All</option>
<option value="manage_posts">Manage posts</option>
</select>
</p>
<p>
<input type="submit" name="add_admin" value="Add admin">
</p>
</form>
<?php endif; ?>
This will ask for the admin’s email and password along with the role that you want to assign to him.
INSERT sub-admin in MySQL database
Now we will write the code to save his data in the database:
// check if request is for adding admin
if (isset($_POST["add_admin"]))
{
// check if main admin
if (isset($_SESSION["admin"]) && $_SESSION["admin"]->role == "all")
{
// get values
$email = $_POST["email"];
$password = password_hash($_POST["password"], PASSWORD_DEFAULT);
$role = $_POST["role"];
// check if email already exists
$result = mysqli_query($conn, "SELECT * FROM admins WHERE email = '" . $email . "'");
if (mysqli_num_rows($result) > 0)
{
echo "<p>Email already exists.</p>";
}
else
{
// save in database
mysqli_query($conn, "INSERT INTO admins (email, password, role) VALUES ('" . $email . "', '" . $password . "', '" . $role . "')");
echo "<p>Admin has been added.</p>";
}
}
else
{
echo "<p>Sorry, you cannot perform this action.</p>";
}
}
First, this will check that the logged-in admin must have an access to create sub-admin. Then it will get all the fields, it also converts the plain text password into hashed string. Then it checks if an admin with same email already exists, if not then it saves the data in database and display a success message.
Show all sub-admins to super admin
Now we need to show all sub-admins to super admin so he can know all his sub-admins along with their roles, and also an ability to delete any sub-admin. Below code should be written after the “Add admin” form:
<?php
// show all admins
$all_admins = mysqli_query($conn, "SELECT * FROM admins WHERE id != '" . $_SESSION["admin"]->id . "'");
while ($admin = mysqli_fetch_object($all_admins)):
?>
<p>
<?php echo $admin->email . " - " . $admin->role; ?>
<!-- button to delete admin -->
<form method="POST" onsubmit="return confirm('Are you sure you want to delete ?');">
<input type="hidden" name="id" value="<?php echo $admin->id; ?>">
<input type="submit" name="delete_admin" value="Delete">
</form>
</p>
<hr>
<?php endwhile; ?>
This will show all sub-admins to super admin only. When the delete button is clicked, it will first ask for confirmation. When confirm, it will submit the form. Now we need to handle the form submission in PHP:
// check if request is for deleting admin
if (isset($_POST["delete_admin"]))
{
// check if main admin
if (isset($_SESSION["admin"]) && $_SESSION["admin"]->role == "all")
{
// get value
$id = $_POST["id"];
// delete from database
mysqli_query($conn, "DELETE FROM admins WHERE id = '" . $id . "'");
echo "<p>Admin has been deleted.</p>";
}
else
{
echo "<p>Sorry, you cannot perform this action.</p>";
}
}
This will simply check that the logged-in admin must be a super admin. Then it will delete the admin from database. When a sub-admin is deleted, all his created posts will also be deleted as well. If you want the sub-admin posts to stay after his removal, you need to remove the “ON DELETE CASCADE ON UPDATE CASCADE” clause from “posts” table during creation.
Sub-admins
Now we come to the sub-admin part. Sub admins can perform action based on their roles. For example, sub admin having role “manage_posts” can create, edit and delete posts. First we will create a form to add post:
<!-- check if admin has permission to manage posts -->
<?php if ($_SESSION["admin"]->role == "all" || $_SESSION["admin"]->role == "manage_posts"): ?>
<!-- form to add new post -->
<h1>Add post</h1>
<form method="POST">
<p>
<input type="text" name="title" placeholder="Enter title" required>
</p>
<p>
<input type="submit" name="add_post" value="Add post">
</p>
</form>
<?php endif; ?>
This will check that the logged-in admin must either be a super admin or admin having role “manage_posts”. Now we need to handle its request in PHP:
// check if request is for adding post
if (isset($_POST["add_post"]))
{
// check if admin has permission to manage posts
if (isset($_SESSION["admin"]) && ($_SESSION["admin"]->role == "all" || $_SESSION["admin"]->role == "manage_posts"))
{
// get values
$title = $_POST["title"];
$created_by = $_SESSION["admin"]->id;
// save in database
mysqli_query($conn, "INSERT INTO posts (title, created_by) VALUES ('" . $title . "', '" . $created_by . "')");
echo "<p>Post has been added.</p>";
}
else
{
echo "<p>Sorry, you cannot perform this action.</p>";
}
}
We need to validate the sub-admin role in server side as well. Get all fields from input fields, and logged in admin ID so we can know which sub-admin created that post. Then we will insert the data in database.
Now we need to show all posts of sub-admin created by him so he can perform further actions like updating or deleting post.
<?php
// get all posts
$all_posts = mysqli_query($conn, "SELECT * FROM posts WHERE created_by = '" . $_SESSION["admin"]->id . "'");
while ($post = mysqli_fetch_object($all_posts)):
?>
<p>
<?php echo $post->title; ?>
<!-- button to delete post -->
<form method="POST" onsubmit="return confirm('Are you sure you want to delete ?');">
<input type="hidden" name="id" value="<?php echo $post->id; ?>">
<input type="submit" name="delete_post" value="Delete">
</form>
</p>
<hr>
<?php endwhile; ?>
This will fetch all posts created by logged-in admin from database and display their titles along with a button to delete. When the delete form is submitted, it will ask for confirmation, once confirm it will submit the form. Now we need to handle the form request on server side:
// check if request is for deleting post
if (isset($_POST["delete_post"]))
{
// check if admin has permission to manage posts
if (isset($_SESSION["admin"]) && ($_SESSION["admin"]->role == "all" || $_SESSION["admin"]->role == "manage_posts"))
{
// get value
$id = $_POST["id"];
// check if post is created by logged in admin
$result = mysqli_query($conn, "SELECT * FROM posts WHERE id = '" . $id . "' AND created_by = '" . $_SESSION["admin"]->id . "'");
if (mysqli_num_rows($result) == 0)
{
echo "<p>Sorry you cannot perform this action.</p>";
}
else
{
// delete from database
mysqli_query($conn, "DELETE FROM posts WHERE id = '" . $id . "' AND created_by = '" . $_SESSION["admin"]->id . "'");
echo "<p>Post has been deleted.</p>";
}
}
else
{
echo "<p>Sorry, you cannot perform this action.</p>";
}
}
Again it will check if the logged-in admin is either super admin or has a role to manage posts. Additionally, it will also check if the post he is trying to delete is created by him. That’s how it will be secured. If all validations are passed then it will simply delete the post from database.
That’s how you can create multiple admin roles and assign the roles by admin capability.
[wpdm_package id=’833′]
Hi, I read your blogs regularly. Your humoristic style is witty, keep doing what
you’re doing!