title: Setting user privileges in PHP and MYSQL
body: <p>I want to make some of my php pages accessible to certain users. I flag these users in my users table as 'super_user' in the 'user_privilege' attribute. So fat I have got the login and sessions working. But I'm not sure about 'super_user' only pages. Basically this is the page I want to make accessible only to super users:</p>
  
  <pre><code>&lt;?php
  require_once('../includes/su_permission.inc.php');
  require_once('../includes/session_timeout_db.inc.php');
  ?&gt;
  &lt;!DOCTYPE HTML&gt;
  &lt;html&gt;
  &lt;head&gt;
  &lt;meta charset="utf-8"&gt;
  &lt;title&gt;Secret page&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
  &lt;h1&gt;Restricted area&lt;/h1&gt;
  &lt;p&gt;&lt;a href="menu_db.php"&gt;Back to restricted menu&lt;/a&gt; &lt;/p&gt;
  &lt;?php include('../includes/logout_db.inc.php'); ?&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The session_timeout_db.inc.php doc checks if the user's session has expired and it works fine. I have also added this: require_once('../includes/su_permission.inc.php'); in the code to check if the user is a super user. This my attempt at the code:</p>
  
  <pre><code>&lt;?php
  require_once 'login.php';
  $conn = new mysqli ($host, $user, $password, $database) or die("Connection Failed");
  
  $sql = 'SELECT user_role FROM users WHERE user_email = ?';
  
  $stmt = $conn-&gt;stmt_init();
  $stmt-&gt;prepare($sql);
  
  $stmt-&gt;bind_param('s', $user_email);
  
  $stmt-&gt;bind_result($user_role);
  $stmt-&gt;execute();
  $stmt-&gt;fetch();
  
  if ($user_role='SU') {
    $_SESSION['privilege_level'] = $user_role;
  
  // some other code needed here
    exit;
  } else {
    echo 'No permission to visit this page';
  }
  </code></pre>
  
  <p>I know it is a poor attempt, but I'm not sure what else to do from here. Can someone please advice the best way I can do this ? </p>
  
  <p>Thanks</p>