What are the best practices for implementing user authentication and access control in PHP scripts?

User authentication and access control are essential for securing PHP scripts. Best practices include using secure hashing algorithms for storing passwords, implementing session management to track logged-in users, and using role-based access control to restrict access to certain parts of the application based on user roles.

// Example of user authentication and access control in PHP

// Start session
session_start();

// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit();
}

// Check user role for access control
if ($_SESSION['role'] !== 'admin') {
    echo 'Access denied';
    exit();
}