php - Authenticate users based on url with regular expressions -

i building php user login , administration system. every user has role specified administrator.

let's role has value url=/users/*. means user role should access every webpage sits in directory /users. eg users should access mydomain.com/users/myprofile.php, mydomain.com/users/friends/index.php not mydomain.com/foo/index.php.

i think solution achieve regular expressions.

eg. have rule url=/users/*. replace * sign regular expression, remove url= @ start of rule, url of page user visited , perform preg_match(rule,url), if returns yes user authenticated, if not redirect him.

questions:

1. regular expression * sign should replaced? thinking of [a-za-z0-9\-\#]+.

2. safe use $_server['request_uri'] current url user visited. safe use purpose?

3. there other way of achieving that?

you might @ different angle. usually, every page have method checking user's credentials - confirm rights has allow him access page. so, example, every page in users/ directory call function checks user's cookie , confirms in user group.

you don't need check $_server['request_uri'] because page knows (if not, use __dir__ etc.)

if need more complicated, can set user capabilities , check these page additions e.g.

if ($visitor->hascapability(x) {     showlink(); //etc. etc. }