查看某些页面的权限
我正在创建一个有两个用户界面的网站。一份供卖家使用，一份供买家使用。目前，我将这些文件存储在一个文件夹下（例如：/interfaces/frame.php），因此对于这两种情况，文件都存储在那里。
我可以通过检查数据库中的用户类型来验证用户身份，并确保它是否是买家，他们只能看到买家界面，如果是卖家，则只能看到卖家界面。问题是这些文件可以公开访问，所以如果您访问domain.com/interfaces/frame.php，它会向您显示它。
我可以进行哪些更改，以便它们不能公开访问，但我可以将它们提供给用户。
我正在使用 include("file.php");用于加载相应的用户界面。
I am creating a website where there are two user intefaces. ONe for sellers and one for buyers. Currently, I am storing these files under a folder (e.g: /interfaces/frame.php) So for both cases the files are stored there.
I am able to authenticate the user by checking the database for user type and making sure if its a buyer they only get to see buyer interface and if seller then seller interface. The problem is that these files can publicly be accessed, so if you go to domain.com/interfaces/frame.php it will show it to you.
What changes can i make so that they are not publicly accessible but yet i can serve them to the user.
I am using include("file.php"); for loading the respective user interfaces.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以将这些文件存储在 Web 根目录下，因此如果您的目录如下所示：
您仍然可以包含包含文件夹中的文件，并且由于它们位于 Web 根目录下，因此无法公开访问它们。
另一种方法是在所有需要权限的文件的顶部包含一个 php 文件，该文件检查会话变量以查看是否允许它们访问该文件。如果它们不使用标头来重定向它们
You can store those files under the web root so if your directory is like this:
you can still include files from the includes folder, and since they are underneath the web root, they cannot be accessed publicly.
Another approach is to include a php file at the top of all permission-required files that checks the session variable to see if they are allowed to access that file. If they are not use a header to redirect them
基本上 PHP 不绑定到大多数 Web 服务器的 Webroot。
因此，如果您有良好的托管服务，您应该能够将 PHP 文件存储在根本无法从网络访问的文件夹中。然后，您应该存储一个仅在 Web 文件夹中显示内容的 php 文件，另一个调用数据库或在服务器的非 Web 文件夹中包含数据的文件。
Web 可以通过文件系统路径（而不是 Web URL）调用非 Web 。
（这将是 Jonathan 在他的 awnser 中提到的 MVC 模式的一个非常非常轻量级的实现）。
当您准备好使用框架时，我会推荐 Zend Framework。
Basically PHP is NOT bound to the Webroot with most Webservers.
So if you have a good hosting service you should be able to store PHP Files in a folder that is NOT accesible from the web at all. You then should store a php file that is just displaying things in the web folder and another one calling the database or containing data in the non web folder of your server.
The Web one can call the none web one via file system paths (not Web URLs).
(That would be a very, very lightweight implementation of the MVC Pattern Jonathan mentioned in his awnser).
When you're ready for using frameworks I would recommend Zend Framework.
最基本的是，您可以在每个文件中添加检查，以确保通过 include、
main.php
然后在includefile.php中
At its most basic you can add a check in each on of your files to make sure its called via an include,
main.php
then in includefile.php
您可能会考虑研究模型视图控制器开发模式，并在请求页面本身时在控制器中执行访问逻辑。我建议将 CodeIgniter 和 Kohana 作为两个出色的开发框架。它们都非常简单，可以帮助您在几分钟内解决这个问题。
当然，您还需要对数据库进行一些配置以适应组和角色。这样，您可以将用户添加到组中，然后授予某些组对某些页面的访问权限。
You might consider looking into the Model View Controller development pattern, and perform access-logic in the controller when the pages themselves are requested. I would suggest both CodeIgniter and Kohana as two great frameworks to develop on. They are both very simple, and would help you address this problem in minutes.
Of course you would also need to make some provisions to your database to accomodate groups and roles. That way you would add users to groups, and then grant certain groups access to certain pages.