php如何实现动态表单字段权限控制_php根据用户角色显示隐藏输入项方法

roles: id, name (admin/editor/user)
fields: id, field_name ('status', 'title', 'author')
field_permissions: role_id, field_name, can_view, can_edit

session_start();
$user_role = $_SESSION['role'] ?? 'user';
<p>// 从数据库查询该角色的字段权限
$sql = "SELECT field_name, can_view, can_edit FROM field_permissions WHERE role_id = (SELECT id FROM roles WHERE name = ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$user_role]);
$permissions = [];
while ($row = $stmt->fetch()) {
$permissions[$row['field_name']] = $row;
}</p>

<form method="post">
  <!-- 标题字段 -->
  <?php if ($permissions['title']['can_view']): ?>
    <div>
      <label>标题</label>
      <input 
        type="text" 
        name="title" 
        value="<?= htmlspecialchars($data['title'] ?? '') ?>"
        <?php if (!$permissions['title']['can_edit']) echo 'readonly'; ?>
      >
    </div>
  <?php endif; ?>
<p><!-- 发布状态字段 -->
<?php if ($permissions['status']['can_view']): ?>
<div>
<label>状态</label>
<select name="status" <?php if (!$permissions['status']['can_edit']) echo 'disabled'; ?>>
<option value="draft">草稿</option>
<option value="published">已发布</option>
</select>
</div>
<?php endif; ?>
</form></p>

// 接收数据前校验权限
foreach ($_POST as $key => $value) {
    if (!isset($permissions[$key]) || !$permissions[$key]['can_edit']) {
        // 非法字段或无编辑权限，忽略或报错
        unset($_POST[$key]); // 或记录日志、抛出异常
    }
}
// 再进行实际的数据保存