<p>I have been using PHP and JavaScript for building my dad's website. He wants to incorporate a login system into his website, and I have the design for the system using PHP. My problem is how do I show buttons if the person is logged in?­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­</p>

<p><strong>For Example -</strong> You have <em>Home</em>, <em>Products</em>, <em>About Us</em>, and <em>Contact</em>. I want to have buttons for <em>Dealer</em>, <em>Distributor</em>, and maybe other information if the user is logged in.  So I will have <em>Home</em>, <em>Products</em>, <em>About Us</em>, <em>Contacts</em>, Dealer (if dealer login), <em>Distributor</em> (if distributor login), and so forth.  </p>

<p>Would JavaScript be a good way to do this or would PHP, or maybe even both? Using JavaScript to show and hide buttons, and PHP to check to see which buttons to show.
­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­­</p>

[{'answer_id': 7033, 'author': 'EndangeredMassa', 'author_id': 106, 'author_profile': 'https://Stackoverflow.com/users/106', 'pm_score': 2, 'selected': False, 'text': "<p>If you use javascript to hide the buttons, you open a security hole in the application. A malicious user could either disable javascript or apply some of their own to get around your security.</p>\n\n<p>I suggest using PHP to chose to either render the buttons or not. I do this in .NET quite often. </p>\n\n<p>You should be able to check the user's access on the server-side whenever they try to use a restricted button as well.</p>\n"}, {'answer_id': 7087, 'author': 'Christian Lescuyer', 'author_id': 341, 'author_profile': 'https://Stackoverflow.com/users/341', 'pm_score': 5, 'selected': True, 'text': "<p>Regarding security, <strong>you cannot trust what comes from the client</strong>:</p>\n\n<ul>\n<li>The visitor can see all your code (HTML and Javascript, not PHP) and try stuff</li>\n<li>The visitor may not even use a browser; it's trivially easy to send a request with a script</li>\n</ul>\n\n<p>This means hiding the buttons is good User Interface design (because you can't use them if you are not logged in). But it's not a security feature. The security feature is checking, on the server, that the visitor is logged in before each action that requires it.</p>\n\n<p>If you don't intend to show the buttons, it's not useful to send the HTML and images to the browser and then hide them with Javascript. I would check with PHP.</p>\n"}, {'answer_id': 7466, 'author': 'grom', 'author_id': 486, 'author_profile': 'https://Stackoverflow.com/users/486', 'pm_score': 1, 'selected': False, 'text': "<p>What we have done at my work is have a library the provides functions such as checking if the user is logged in. For example:</p>\n\n<pre><code>&lt;?php\nrequire_once 'Auth.php';\n// output some html\nif (isLoggedIn()) {\n    echo 'html for logged in user';\n}\n// rest of html\n</code></pre>\n\n<p>For pages that only authenicated users should see, the controller checks if they are logged in and if not it redirects them to the login page.</p>\n\n<pre><code>&lt;?php\npublic function viewCustomer($customerId) {\n    if (!isLoggedIn())\n        redirectToLoginPage();\n}\n</code></pre>\n"}, {'answer_id': 7473, 'author': 'Akira', 'author_id': 795, 'author_profile': 'https://Stackoverflow.com/users/795', 'pm_score': 3, 'selected': False, 'text': '<p>In your menu file or w/e you put:</p>\n\n<pre><code>&lt;? require \'auth.php\' ?&gt;\n&lt;ul&gt;\n    &lt;li&gt;&lt;a href=""&gt;Home&lt;/a&gt;&lt;/li&gt;\n    &lt;li&gt;&lt;a href=""&gt;Products&lt;/a&gt;&lt;/li&gt;\n    &lt;? if( loggedin() ): ?&gt;&lt;li&gt;&lt;a href=""&gt;Secret area&lt;/a&gt;&lt;/li&gt;&lt;? endif; ?&gt;\n&lt;/ul&gt;\n</code></pre>\n\n<p>Then in pages that require auth just do this:</p>\n\n<pre><code>&lt;?php \n    require \'auth.php\';\n    require_login();\n?&gt;\n</code></pre>\n\n<p>Where auth.php may contain:</p>\n\n<pre><code>&lt;?php\n    function loggedin(){\n        return isset( $_SESSION[\'loggedin\'] );\n    }\n\n    function require_login(){\n        if( !loggedin() ){\n            header( \'Location: /login.php?referrer=\'.$_SERVER[\'REQUEST_URI\'] );\n            exit;\n        }\n    }\n?&gt;\n</code></pre>\n'}, {'answer_id': 26602, 'author': 'buti-oxa', 'author_id': 2515, 'author_profile': 'https://Stackoverflow.com/users/2515', 'pm_score': 1, 'selected': False, 'text': '<p>Everything that Christian Lescuyer wrote is correct. Notice, however, that he said "I would" and not "you should". The choice is not that easy.</p>\n\n<p>First of all, security is not an issue in the choice. You should have security check on server when you execute an action. Which code decides to show/hide the button that leads to the action is irrelevant. </p>\n\n<p>That leaves us with only one drawback of doing show/hide logic in Javascript - the HTML sent to user is bigger than necessary. This may not be a big deal.</p>\n\n<p>Having show/hide logic in PHP does have a minus, though. The PHP code required is usually a <a href="http://www.codinghorror.com/blog/archives/001155.html" rel="nofollow noreferrer">tag soup</a>. Akira\'s code provides a good example of how it is usually done.</p>\n\n<p>Corresponding Javascript code would probably look something like this:</p>\n\n<pre><code>if (logged())\n{\n    elementSecretArea.style.display = "list-item";\n}\n</code></pre>\n\n<p>(assuming that elements that could be hidden have display:none by default).</p>\n\n<p>This style also allows nice "Ajax" scenario: user sees a page w/o secret area, inputs password, sees the secret area all without refreshing the page.</p>\n\n<p>So, if you already have a script that runs when your document load for other reasons, I would seriously consider having show/hide logic there.</p>\n'}, {'answer_id': 1446276, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 0, 'selected': False, 'text': '<p>Basically where you have your menu in html, say as a list <code>&lt;ul&gt; &lt;li&gt;Home&lt;/li&gt; &lt;/ul&gt;</code> you add php after <code>&lt;/li&gt;</code> of the last item:</p>\n\n<pre><code>&lt;?php\n  if($session-logged_in) {    \n?&gt;\n\n&lt;li&gt;My Account&lt;/li&gt;\n\n&lt;?php  \n  }\n?&gt; \n</code></pre>\n'}]
['https://Stackoverflow.com/questions/7031', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/876/']