Member Avatar for danielbala

i got 3 users to be registered in the registration form through radio button admin,manager and employee... after registration of a admin the other 2 raadio buttons shud only enable in the registration form...

admin shud be disable............

how to implement this in php...........

  • 4 Contributors
  • 10 Replies
  • 140 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Short summary: the radio button for "admin" should never be the sole gatekeeper for creating an administrative account. As and pointed out, letting a public form decide roles is a security risk. The safe patterns are: (A) remove role selection from public registration, or (B) allow admin creation only through a protected workflow (an authenticated admin interface or a one‑time invite token). 's link is useful for basic form handling, but it does not cover the authorization issues raised here.

Practical rules to follow

  • Never trust client input for role/privilege assignment. Always determine role on the server.
  • If you want only one initial admin, compute that from the database and enforce it inside a transaction so two simultaneous registrations cannot both become admin.
  • Prefer an invite/token workflow for new admin accounts rather than exposing an "admin" option on the public form.

Example checks and safe flow (conceptual)

  • To decide whether to show an admin option on an internal admin-only page, check the DB count of admins and the requesting user session.
  • To avoid race conditions when creating the first admin, wrap the existence check and insert in a transaction and lock appropriately.
-- check if any admin exists
SELECT COUNT(*) FROM users WHERE role = 'admin';

-- when creating, use a transaction:
START TRANSACTION;
SELECT COUNT(*) FROM users WHERE role = 'admin' FOR UPDATE;
IF count == 0 THEN
  INSERT INTO users (..., role='admin', ...);
END IF;
COMMIT;

Invite/token workflow (recommended for controlled admin creation)

-- invites table: id, token_hash, created_by, expires_at, used_at
-- flow:
-- 1) existing admin creates invite -> store token hash
-- 2) candidate registers with token -> server verifies token, marks it used, assigns 'admin' role

Additional hardening: use prepared statements, PHP's password_hash() for passwords, CSRF tokens on forms, audit logging, and strict server-side authorization checks. See the PHP docs for password_hash (php.net) and the OWASP Access Control guidance (cheatsheetseries.owasp.org) for more on secure design.

Recommended Answers

All 10 Replies

Member Avatar for danielbala

do u have sample code..its very messy
i need the exact code........

Member Avatar for Member #120589

I don't understand why you're giving a registering user the choice of which level to enter - surely this is a security flaw?
If this is a publically viewable form, it could be easily spoofed in order to send data with 'admin' enabled/selected.

I was going to post the code, but then, I saw your reply. Try it yourself first - don't be lazy! :)

Edited by Member #120589 because: n/a
Member Avatar for danielbala

hmm....please can u send me the code..i tried but...

Edited by danielbala because: n/a
Member Avatar for Member #120589

If you tried, show us what you got. This is a help forum, not a free lunch forum.

If the form is only for an admin to fill out, I don't see why you need the admin radio option in the first place, as he/she will have registered as an admin SOMEHOW already.

Member Avatar for danielbala 
//submit form get the data etc...
$buttons = array("button1" => 0, "button2" = 1);

foreach($buttons as $key => $but){
   if($but == 1){
      echo "<input type="radio" name='" . $key . "' disabled='disabled'/>"
   }else{
      echo "<input type="radio"  name='" . $key . "' /> &&"<input type="radio"  name='" . $key . "' />
   }
}

is this correct code????

i gave name as role and value as 1 for admin

Edited by Ezzaral because: Added code tags. Please use them to format any code that you post.
Member Avatar for Member #120589

how about:

<?php
if(!admin_exists){
  echo '<input name="level" id="adminlevel" type="radio" value="2" /> <label for="adminlevel">admin</label>';
}
?>
<input name="level" id="manlevel" type="radio" value="1" /> <label for="manlevel">manager</label>
<input name="level" id="employeelevel" type="radio" value="0" /> <label for="employeelevel">employee</label>

That should work for a secured form (if only an admin can get at it). HOWEVER, using plaintext or integer values is dangerous if not, as anybody can spoof a form and send it as an admin (even if they're not).

One way to prevent this is to hash the values with something like this:

$adminhash = md5('thisisadmin97531');
// so then
if(!admin_exists){
  echo '<input name="level" id="adminlevel" type="radio" value="' . $adminhash . '" /> <label for="adminlevel">admin</label>';
}

You then need to check on form handling for $_POST - use a switch or if/elseif/else... to check for accepted values, which are:

eb9ef3335cf3726752e8008b5bbe9b74 (admin)
1 (manager)
0 (employee)

But this is pretty hypothetical as we don't know HOW this is being used. As I said, individuals should never be allowed to enter their level of access/rights/permissions.

Member Avatar for mikulucky

I agree this is going to cause serious problems allowing users to be any level they wish!!!! The site will not last more than a week online with that security!!!

Member Avatar for danielbala

(wht i have to give for admin_exists for and $adminhash = md5('thisisadmin97531');

if(!admin_exists){
  echo '<input name="level" id="adminlevel" type="radio" value="2" /> <label for="adminlevel">admin</label>';
}
Edited by Ezzaral because: Added code tags. Please use them to format any code that you post.
Member Avatar for Member #120589

Before you ask any more questions about the code. Answer my question - how is this going to be used and by whom? This will enable us to answer you correctly. At the moment I can only guess at what you wish to achieve.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.