新闻发布授权系统

Question

我正试图为我的网站制作一个新闻页面，以确保用户在数据库中是所有者级别，这是有效的，但当我更改我的排名时，您仍然可以看到应该显示的消息，如果您是正确的排名。

新闻页的代码

<?php
  require_once('appvars.php');
  require_once('connectvars.php');

  // Make sure the user is logged in before going any further.
  if (!isset($_SESSION['user_id'])) {
    echo '<p class="login">Please <a href="login.php">log in</a> to access this page.</p>';
    exit();
  }
  else {
    echo('<p class="login">You are logged in as ' . $_SESSION['username'] . '. <a href="logout.php">Log out</a>.</p>');
  }

  // Connect to the database
  $dbc = mysqli_connect(DB_HOST, DB_USER, DB_PASSWORD, DB_NAME);

  // Grab the profile data from the database
  if (!isset($_GET['user_id'])) {
    $query = "SELECT rank FROM kaoscraft_user WHERE user_id = '" . $_SESSION['user_id'] . "'";
  }
  else {
    $query = "SELECT rank FROM kaoscraft_user WHERE user_id = '" . $_GET['user_id'] . "'";
  }
  $data = mysqli_query($dbc, $query);


  if (!$row['rank'] = 'Owner') {
  echo 'Youre not logged in';
  }

  else {
  echo 'Welcome';
  }

  mysqli_close($dbc);
?>

Answer 1

if (!$row['rank'] = 'Owner')

那是任务，不是平等检查。使用==进行等式检查。一旦更改了这个值，就必须实际设置$row的值。

$data = mysqli_query($dbc, $query);
$row = $data->fetch_assoc();

if (!isset($row['rank']) || !$row['rank'] == 'Owner') {
    echo 'Youre not logged in';
}

else {
    echo 'Welcome';
}