PHP 中的逻辑或运算符

Question

In my webpage I have 2 roles 'User' and 'Admin'. Admins have access to Create, Read, Update, and Delete. Users have access to Create, but can also see short parts of the record on the overview table.

if ($_SESSION['userRole'] !== 'ADMIN') {
    header("Location:index.php");
    exit;
}

This is what i use normally before the change i want to verify the role in the edit.php. And i have also tried this to allow Users to edit as well.

if ($_SESSION['userRole'] !== 'ADMIN' or !== 'USER') {
    header("Location:index.php");
    exit;
} 
//////////////////////////////////////////////////////////////
if ($_SESSION['userRole'] !== 'ADMIN' || !=='USER') {
    header("Location:index.php");
    exit;
}
//////////////////////////////////////////////////////////////
if ($_SESSION['userRole'] !== 'ADMIN') {
    header("Location:index.php");
    exit;
}elseif ($_SESSION['userRole'] !== 'USER') {
    header("Location:index.php");
    exit;
}

When pressing the Edit button. The page doesn't do anything. This happens on Admin and User

Answer 1

First, i'll think you should work with integers instead of strings like

$_SESSION["role"] = 666; //Admin
$_SESSION["role"]  = 1;  //User

in your login.

if($_SESSION["role"] === 666){

  // redirect to the admin-page

}elseif($_SESSION["role"] === 1){

  // redirect to users-page  

}else{

  //redirect your "both" page

}

Try to check if the redirect page exists or throw an error if not.

Good luck to you

Answer 2

try this source, I think errors will come from "header already sent"

if ($_SESSION['userRole'] !== 'ADMIN' OR $_SESSION['userRole'] !== 'USER') {
    echo '<script> window.location.replace("https://www.example.com"); </script>';
    die();
} 
//////////////////////////////////////////////////////////////
if ($_SESSION['userRole'] !== 'ADMIN' || $_SESSION['userRole'] !=='USER') {
    echo '<script> window.location.replace("https://www.example.com"); </script>';
    die();
}
//////////////////////////////////////////////////////////////
if ($_SESSION['userRole'] !== 'ADMIN') {
echo '<script> window.location.replace("https://www.example.com"); </script>';
    die();
}elseif ($_SESSION['userRole'] !== 'USER') {
    echo '<script> window.location.replace("https://www.example.com"); </script>';
    die();
}