What are the potential pitfalls of storing user rights in sessions versus querying the database for each action in PHP?

Storing user rights in sessions can lead to potential security risks if the session data is tampered with or if the user's rights change while the session is active. Querying the database for each action ensures that the user's current rights are always accurately reflected. To mitigate this issue, it is recommended to query the database for user rights on each action to ensure the most up-to-date information is being used. 

// Check user rights from the database before performing any action
$user_id = $_SESSION['user_id'];
$query = "SELECT rights FROM users WHERE id = $user_id";
$result = mysqli_query($conn, $query);
$row = mysqli_fetch_assoc($result);

if ($row['rights'] == 'admin') {
    // Perform admin action
} else {
    // Perform regular user action
}

Keywords

sessions database querying user rights security performance

Related Questions