It happens that I have a few pages for admin only access, and each user of my site has an entry in a MySQL database. There is a column named Rank, and there are two valid values for this column, Admin and User. To protect my content I'm using code like this:
if($user->rank == "Admin"){
//Code Here
}else{
echo "youre not a admin!"
}
So my question is: Is this page protected?
I know if someone hacks into my database by any other means and change their rank to Admin, they can access this page, but besides that case, is this secure?
Security is not a binary thing, it's more of a continuum. It's impossible to designate a site or application as secure based on a few lines of code.
Provided there are no holes in your security elsewhere, that piece of code is secure.
It may be simpler to do this:
<?php
if($user->rank != "Admin"){
echo "youre not a admin!"
exit();
}
...(other php code)
?>
...(other code for the page)
exit(); will stop processing so none of the code below it will be executed and non-admin users will not see it. See the docs.
Your code is perfectly fine. When someone accesses the file with that code in it, it is processed on the server side; The client never sees it.
Of course, if someone gained access to your servers file system and opened the file for editing, they would be able to modify it. But, if they do that then I fear you'd have bigger problems.
