How was user authorization implemented?

In PHP, user authentication is usually implemented through sessions and cookies. After successfully verifying the login and password, the user's data is stored in the session, for example, the user ID or role. Each request checks for the presence and validity of the session to determine if the user is authorized.

For security, it is important to use password hashing (e.g., password_hash and password_verify), protect sessions from hijacking (e.g., regenerate session ID after login), and use HTTPS.

A simple example of authentication:

session_start();

// Login check
if ($_POST['login'] === 'user' && password_verify($_POST['password'], $hashFromDb)) {
    $_SESSION['user_id'] = $userId;
    $_SESSION['role'] = $userRole;
}

// Authorization check
if (isset($_SESSION['user_id'])) {
    echo "User is authorized";
} else {
    echo "Login required";
}