Issue with user security groups. Advice/Examples needed.

[reisende]

Hello all,

I would like to find the best way to display content based on a users group permission settings. I'm using a method right now that I can't help but think is inefficient, but I'm still pretty novice at PHP.

What I have is a table with four groups defined, we'll call them A, B, C and D. Now each user, file and news article has a cross reference table that sets whether the user is a part of a group and what groups should have access to the files and articles.

When a user logs in I do a query to determine which groups they are a part of:

$strSQL = "SELECT * FROM user_groups WHERE g_user_id = ".$userid.";";
$result = mysql_query($strSQL);
while ($obj = mysql_fetch_object($result)) {
  $g_is_a = $obj->g_user_a;
  $g_is_b = $obj->g_user_b;
  $g_is_c = $obj->g_user_c;
  $g_is_d = $obj->g_user_d;
}

Where I'm having the problem is I want to find something simple that will build the SQL to select the files and articles based on the user settings.

I really don't want to have to check each group and possible combination of groups and build SQL that way. That could get to a hundred lines and be a big mess.

In essence, say they have access to two groups then this is generated:

$formSQL = "SELECT * FROM files JOIN file_cats ON cat_id = file_cat JOIN file_groups ON g_file_id = file_id WHERE cat_title = 'Forms' AND g_file_a = 1 OR g_file_c = 1;";

$newsSQL = "SELECT * FROM articles JOIN article_groups ON g_article_id = article_id WHERE article_active = 1 AND g_article_a = 1 OR g_article_c = 1 ORDER BY article_date DESC;";

And etc., etc., etc.

Any ideas or suggestions? I would really love hearing them and would appreciate them greatly.

Thanks.