eenvoudige maar flexibele ACL

<?php
// helper
function validateNumber($in) {
    return preg_match('#^[1-9][0-9]*$#', $in);
}

function validateSerializedString($in) {
    // empty string is always correct
    if ($in == '') {
        return true;
    }
    $operators = 0; // the added & operator will be counted automatically below
    $operands  = 1; // the added "true" on the (imaginary) stack

    // we add "&& true" to ensure at least two operands ($in could consist of exactly one right)
    $in = explode(',', '&,'.$in); // mind the prefixed "&,"

    foreach ($in as $token) {
        $current = $token;
        if ($token{0} == '!') {
            $current = substr($token, 1);
        }
        if ($current == '|' || $current == '&') {
            $operators++;
        } elseif (validateNumber($current)) {
            $operands++;
        } else {
            // illegal character (sequence)
            return false;
        }
    }
    return ($operators + 1 == $operands);
}

function isAllowed($in, $rights=array()) {
    if ($in == '') {
        return true;
    }
    // we add "&& true" to ensure at least two operands ($in could consist of exactly one right)
    $stack = array(true);
    $in = array_reverse(explode(',', '&,'.$in)); // read from back to front, mind the prefixed "&,"
    foreach ($in as $token) {
        $negate = false;
        $current = $token;
        if ($token{0} == '!') {
            $negate = true;
            $current = substr($token, 1);
        }
        if ($current == '|' || $current == '&') {
            // $stack should have at least two items - validation should guarantee this
            // note that $val1 and $val2 already are boolean values (true or false)
            $val1 = array_pop($stack);
            $val2 = array_pop($stack);
            // calculate new value to put back on the stack
            $value = ($current == '|' ? $val1 || $val2 : $val1 && $val2);
        } elseif (validateNumber($current)) {
            // add a boolean to the stack indicating whether the user has this right
            $value = in_array($current, $rights);
        }
        // put (intermediate) result back on the stack
        $stack[] = ($negate ? !$value : $value);
    }
    // after this loop $stack should have exactly 1 value - the validation should guarantee this
    return $stack[0];
}
?>

<?php
// helper
function validateNumber($in) {
    return preg_match('#^[1-9][0-9]*$#', $in);
}
 
function validateSerializedString($in) {
    // empty string is always correct
    if ($in == '') {
        return true;
    }
    $operators = 0; // the added & operator will be counted automatically below
    $operands  = 1; // the added "true" on the (imaginary) stack
 
    // we add "&& true" to ensure at least two operands ($in could consist of exactly one right)
    $in = explode(',', '&,'.$in); // mind the prefixed "&,"
 
    foreach ($in as $token) {
        $current = $token;
        if ($token{0} == '!') {
            $current = substr($token, 1);
        }
        if ($current == '|' || $current == '&') {
            $operators++;
        } elseif (validateNumber($current)) {
            $operands++;
        } else {
            // illegal character (sequence)
            return false;
        }
    }
    return ($operators + 1 == $operands);
}
 
function isAllowed($in, $rights=array()) {
    if ($in == '') {
        return true;
    }
    // we add "&& true" to ensure at least two operands ($in could consist of exactly one right)
    $stack = array(true);
    $in = array_reverse(explode(',', '&,'.$in)); // read from back to front, mind the prefixed "&,"
    foreach ($in as $token) {
        $negate = false;
        $current = $token;
        if ($token{0} == '!') {
            $negate = true;
            $current = substr($token, 1);
        }
        if ($current == '|' || $current == '&') {
            // $stack should have at least two items - validation should guarantee this
            // note that $val1 and $val2 already are boolean values (true or false)
            $val1 = array_pop($stack);
            $val2 = array_pop($stack);
            // calculate new value to put back on the stack
            $value = ($current == '|' ? $val1 || $val2 : $val1 && $val2);
        } elseif (validateNumber($current)) {
            // add a boolean to the stack indicating whether the user has this right
            $value = in_array($current, $rights);
        }
        // put (intermediate) result back on the stack
        $stack[] = ($negate ? !$value : $value);
    }
    // after this loop $stack should have exactly 1 value - the validation should guarantee this
    return $stack[0];
}
?>

<?php
$userRights = array('2', '4');
$accessRights = '&,|,1,2,|,3,4'; // (1 | 2) & (3 | 4)

// normally, you check this when storing the access rights
if (validateSerializedString($accessRights)) {
    if (isAllowed($accessRights, $userRights)) {
        echo 'authorized';
    } else {
        echo 'unauthorized';
    }
} else {
    // complain (e.g. throw exception)
    die('did not validate');
}
?>

<?php
$userRights = array('2', '4');
$accessRights = '&,|,1,2,|,3,4'; // (1 | 2) & (3 | 4)
 
// normally, you check this when storing the access rights
if (validateSerializedString($accessRights)) {
    if (isAllowed($accessRights, $userRights)) {
        echo 'authorized';
    } else {
        echo 'unauthorized';
    }
} else {
    // complain (e.g. throw exception)
    die('did not validate');
}
?>

function validateSerializedString($expression) {
    if ($expression == '') {
        return true;
    }
    $operators = 0; // the added & operator will be counted automatically below
    $operands  = 1; // the added "true" on the (imaginary) stack

    // we add "&& true" to ensure at least two operands ($expression could consist of exactly one right)
    $tokens = explode(',', '&,'.$expression); // mind the prefixed "&,"

    foreach ($tokens as $token) {
        if ($token == '&' || $token == '|') {
            $operators++;
        } elseif ($token == '!') {
            // do not count the ! token
        } elseif (validateNumber($token)) {
            $operands++;
        } else {
            // illegal character (sequence)
            return false;
        }
    }
    return ($operators + 1 == $operands);
}

function isAllowed($expression, $rights=array()) {
    if ($expression == '') {
        return true;
    }
    // we add "&& true" to ensure at least two operands ($expression could consist of exactly one right)
    $stack = array(true);
    $tokens = array_reverse(explode(',', '&,'.$expression)); // read from back to front, mind the prefixed "&,"
    foreach ($tokens as $token) {
        if ($token == '&' || $token == '|') {
            // $stack should have at least two items - validation should guarantee this
            // note that $val1 and $val2 already are boolean values (true or false)
            $val1 = array_pop($stack);
            $val2 = array_pop($stack);
            // calculate new value to put back on the stack
            $stack[] = ($token == '|' ? $val1 || $val2 : $val1 && $val2);
        } elseif ($token == '!') {
            // negate whatever is on the top of the stack
            $stack[count($stack)-1] = !($stack[count($stack)-1]);
        } else {
            // this is a number, validation should guarantee this!
            // add a boolean to the stack indicating whether the user has this right
            $stack[] = in_array($token, $rights);
        }
    }
    // after this loop $stack should have exactly 1 value - the validation should guarantee this
    return $stack[0];
}

function validateSerializedString($expression) {
    if ($expression == '') {
        return true;
    }
    $operators = 0; // the added & operator will be counted automatically below
    $operands  = 1; // the added "true" on the (imaginary) stack
 
    // we add "&& true" to ensure at least two operands ($expression could consist of exactly one right)
    $tokens = explode(',', '&,'.$expression); // mind the prefixed "&,"
 
    foreach ($tokens as $token) {
        if ($token == '&' || $token == '|') {
            $operators++;
        } elseif ($token == '!') {
            // do not count the ! token
        } elseif (validateNumber($token)) {
            $operands++;
        } else {
            // illegal character (sequence)
            return false;
        }
    }
    return ($operators + 1 == $operands);
}
 
function isAllowed($expression, $rights=array()) {
    if ($expression == '') {
        return true;
    }
    // we add "&& true" to ensure at least two operands ($expression could consist of exactly one right)
    $stack = array(true);
    $tokens = array_reverse(explode(',', '&,'.$expression)); // read from back to front, mind the prefixed "&,"
    foreach ($tokens as $token) {
        if ($token == '&' || $token == '|') {
            // $stack should have at least two items - validation should guarantee this
            // note that $val1 and $val2 already are boolean values (true or false)
            $val1 = array_pop($stack);
            $val2 = array_pop($stack);
            // calculate new value to put back on the stack
            $stack[] = ($token == '|' ? $val1 || $val2 : $val1 && $val2);
        } elseif ($token == '!') {
            // negate whatever is on the top of the stack
            $stack[count($stack)-1] = !($stack[count($stack)-1]);
        } else {
            // this is a number, validation should guarantee this!
            // add a boolean to the stack indicating whether the user has this right
            $stack[] = in_array($token, $rights);
        }
    }
    // after this loop $stack should have exactly 1 value - the validation should guarantee this
    return $stack[0];
}

AND
+----OR
|    +----[A]
|    +----[B]
|
+----[C]

AND
+----OR
|    +----[A]
|    +----[B]
|
+----[C]

AND,C,OR,A,B

AND,C,OR,A,B

AND
+----[C]
|
+----OR
.    +----[A]
.    +----[B]

AND
+----[C]
|
+----OR
.    +----[A]
.    +----[B]

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>tree</title>
<script type="text/javascript" src="http://code.jquery.com/jquery-1.11.1.min.js"></script>
<style type="text/css">
li.red > span { color: #ff0000; }
</style>
</head>

<body>
<div id="tree_container">
    <ul id="tree">
    <li><span>empty</span></li>
    </ul>
</div>
<p><em>Click on a list item to edit it. Special values: AND, OR, NOT (case sensitive)</em></p>
<button type="button" id="daddy">parents</button>
<button type="button" id="notation">notation</button>
<br />
<textarea id="pn" rows="10" cols="50"></textarea>

<script type="text/javascript">
//<![CDATA[
    // https://github.com/janl/mustache.js/blob/master/mustache.js
     var entityMap = {
    "&": "&amp;",
    "<": "&lt;",
    ">": "&gt;",
    '"': '&quot;',
    "'": '&#39;',
    "/": '&#x2F;'
    };
    function escapeHtml(string) {
        return String(string).replace(/[&<>"'\/]/g, function (s) {
            return entityMap[s];
        });
    }

    $().ready(function() {
        // click event function for building a logical tree
        var handleclick = function(e) {
            // prevent the click event to bubble to the parent when clicking on input
            // so parent li clicks do not get triggered again
            e.stopPropagation();

            var $element = $(this);
            var go = false;
            if ($element.has('ul').length) {
                go = confirm('editing this element will cause the child elements to be deleted; proceed?');
            } else {
                go = true;
            }

            if (go) {
                var value    = $element.find('span').first().text();
                // @todo the next line might remove an entire subtree, do anything to save or cleanup items/events?
                var $html    = $('<input type="text" value="" />').val(value);

                $html.click(function(e) {
                    // so it does not trigger click event of direct parent li
                    e.stopPropagation();
                });

                $html.blur(function() {
                    var value = $(this).val();
                    if (value == '') {
                        value = 'empty';
                    }
                    $element.html('<span>'+escapeHtml(value)+'</span>');
                    if (value == 'AND' || value == 'OR') {
                        $ul = $('<ul></ul>');
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $element.append($ul);
                    } else if (value == 'NOT') {
                        $ul = $('<ul></ul>');
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $element.append($ul);
                    }
                });

                $element.html($html);
                $html.focus();
            } // go
        } // handleclick

        // onload event: add clickevents to initial present list items (serves as init)
        $('#tree li').click(handleclick);

        $('#daddy').click(function() {
            // *ugh* how to select all first list items of an <ul> that contain an <ul>?
            $('#tree_container').find('ul').each(function() {
                // check if a direct descendant is a parent too
                $(this).children('li').each(function() {
                    // reset
                    $(this).removeClass('red');

                    // first element always is a span
                    // note the .length element, if omitted, it returns true regardless of whether
                    // the element actually has a ul within
                    if ($(this).has('ul').length) {
                        $(this).addClass('red');
                    }
                });
            });
        });

        $('#notation').click(function() {
            var out = '';
            // first we check if we need to rearrange the tree
            // we need the simple (non compound) statement in front
            // NOT NEEDED
            /*
            $('#tree_container').find('ul').each(function() {
                var $children = $(this).children('li');
                if ($children.length == 2) {
                    var $child2 = $children.eq(1);
                    var value = $child2.find('span').html();
                    if (value == 'AND' || value == 'OR') {
                        // compound statement, do nothing
                    } else {
                        // second element is simple, check first
                        var $child1 = $children.eq(0);
                        var value = $child1.find('span').html();
                        // if the first element is complex, we need to swap
                        if (value == 'AND' || value == 'OR') {
                            // x.before(y) = put y before x
                            $child1.before($child2);
                        } else {
                            // both elements simple, swapping not needed after all
                        }
                    }
                }
            });
            */
            // next we read the tree from back to front
            // NOT NEEDED
            // $($('#tree li span').get().reverse()).each(function() {
            $('#tree li span').each(function() {
                // NOT NEEDED
                // out = $(this).text()+(out == '' ? '' : ',')+out;
                out = out+(out == '' ? '' : ',')+$(this).text();
            });
            // output the generated string
            $('#pn').val(out);
        });
    });
//]]>
</script>
</body>
</html>

<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>tree</title>
<script type="text/javascript" src="http://code.jquery.com/jquery-1.11.1.min.js"></script>
<style type="text/css">
li.red > span { color: #ff0000; }
</style>
</head>
 
<body>
<div id="tree_container">
    <ul id="tree">
    <li><span>empty</span></li>
    </ul>
</div>
<p><em>Click on a list item to edit it. Special values: AND, OR, NOT (case sensitive)</em></p>
<button type="button" id="daddy">parents</button>
<button type="button" id="notation">notation</button>
<br />
<textarea id="pn" rows="10" cols="50"></textarea>
 
<script type="text/javascript">
//<![CDATA[
    // https://github.com/janl/mustache.js/blob/master/mustache.js
     var entityMap = {
    "&": "&amp;",
    "<": "&lt;",
    ">": "&gt;",
    '"': '&quot;',
    "'": '&#39;',
    "/": '&#x2F;'
    };
    function escapeHtml(string) {
        return String(string).replace(/[&<>"'\/]/g, function (s) {
            return entityMap[s];
        });
    }
 
    $().ready(function() {
        // click event function for building a logical tree
        var handleclick = function(e) {
            // prevent the click event to bubble to the parent when clicking on input
            // so parent li clicks do not get triggered again
            e.stopPropagation();
 
            var $element = $(this);
            var go = false;
            if ($element.has('ul').length) {
                go = confirm('editing this element will cause the child elements to be deleted; proceed?');
            } else {
                go = true;
            }
 
            if (go) {
                var value    = $element.find('span').first().text();
                // @todo the next line might remove an entire subtree, do anything to save or cleanup items/events?
                var $html    = $('<input type="text" value="" />').val(value);
 
                $html.click(function(e) {
                    // so it does not trigger click event of direct parent li
                    e.stopPropagation();
                });
 
                $html.blur(function() {
                    var value = $(this).val();
                    if (value == '') {
                        value = 'empty';
                    }
                    $element.html('<span>'+escapeHtml(value)+'</span>');
                    if (value == 'AND' || value == 'OR') {
                        $ul = $('<ul></ul>');
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $element.append($ul);
                    } else if (value == 'NOT') {
                        $ul = $('<ul></ul>');
                        $ul.append($('<li><span>empty</span></li>').click(handleclick));
                        $element.append($ul);
                    }
                });
 
                $element.html($html);
                $html.focus();
            } // go
        } // handleclick
 
        // onload event: add clickevents to initial present list items (serves as init)
        $('#tree li').click(handleclick);
 
        $('#daddy').click(function() {
            // *ugh* how to select all first list items of an <ul> that contain an <ul>?
            $('#tree_container').find('ul').each(function() {
                // check if a direct descendant is a parent too
                $(this).children('li').each(function() {
                    // reset
                    $(this).removeClass('red');
 
                    // first element always is a span
                    // note the .length element, if omitted, it returns true regardless of whether
                    // the element actually has a ul within
                    if ($(this).has('ul').length) {
                        $(this).addClass('red');
                    }
                });
            });
        });
 
        $('#notation').click(function() {
            var out = '';
            // first we check if we need to rearrange the tree
            // we need the simple (non compound) statement in front
            // NOT NEEDED
            /*
            $('#tree_container').find('ul').each(function() {
                var $children = $(this).children('li');
                if ($children.length == 2) {
                    var $child2 = $children.eq(1);
                    var value = $child2.find('span').html();
                    if (value == 'AND' || value == 'OR') {
                        // compound statement, do nothing
                    } else {
                        // second element is simple, check first
                        var $child1 = $children.eq(0);
                        var value = $child1.find('span').html();
                        // if the first element is complex, we need to swap
                        if (value == 'AND' || value == 'OR') {
                            // x.before(y) = put y before x
                            $child1.before($child2);
                        } else {
                            // both elements simple, swapping not needed after all
                        }
                    }
                }
            });
            */
            // next we read the tree from back to front
            // NOT NEEDED
            // $($('#tree li span').get().reverse()).each(function() {
            $('#tree li span').each(function() {
                // NOT NEEDED
                // out = $(this).text()+(out == '' ? '' : ',')+out;
                out = out+(out == '' ? '' : ',')+$(this).text();
            });
            // output the generated string
            $('#pn').val(out);
        });
    });
//]]>
</script>
</body>
</html>

AND,OR,A,B,C

AND,OR,A,B,C

!(A | B | C)

!(A | B | C)

<?php
class RightsTree
{
    protected $_tree;

    public function __construct($expression) {
        $this->_tree = $this->buildTree($expression);
    }

    protected function buildTree($input) {
        $tree           = array();          // result array
        $freeSpots      = array(0 => 1);    // depth => number of free spots
        $parents        = array();          // stack with indexes of $tree which are parents
        $currentDepth   = 0;

        // list of tokens that will create new free spots at a (one) lower level
        $newSpots = array(
            '&' => 2,
            '|' => 2,
            '!' => 1,
        );
        // mapping to a more readable form
        $map = array(
            '&' => 'AND',
            '|' => 'OR',
            '!' => 'NOT',
        );
        foreach (explode(',', $input) as $position => $token) {
            // find highest level at which there are free spots
            $spotFound = false;
            $d = count($freeSpots) - 1;
            while ($d > -1 && $spotFound === false) {
                if ($freeSpots[$d] > 0) {
                    $currentDepth = $d;
                    $spotFound = true;
                } else {
                    array_pop($freeSpots); // do not inspect this level again (also to prevent popping too many elements from $parents)
                    array_pop($parents); // this parent no longer has any free spots
                    $d--; // look one level lower
                }
            }

            if ($spotFound === false) {
                // complain, e.g. throw exception
                die('malformed expression at position '.$position);
            }

            // add token to tree
            $parent = (count($parents) ? $parents[count($parents)-1] : -1);
            $tree[] = array(
                'parent'    => $parent,
                'children'  => array(),
                'value'     => (array_key_exists($token, $map) ? $map[$token] : $token),
            );
            if ($parent > -1) {
                $tree[$parent]['children'][] = count($tree) - 1; // index of the element we just added
            }

            // subtract free spots
            $freeSpots[$currentDepth] -= 1;

            // is this a token that creates new spots?
            if (array_key_exists($token, $newSpots)) {
                // add number of free spots defined in $spots
                $freeSpots[$currentDepth+1] = $newSpots[$token];
                // this is a new parent
                $parents[] = count($tree) - 1; // index of the element we just added
            }
        } // foreach
        return $tree;
    }

    public function printTree($index=0) {
        // @todo add output escaping
        ?><li><span><?php echo $this->_tree[$index]['value']; ?></span><?php
            if (count($this->_tree[$index]['children'])) {
                ?><ul><?php
                    foreach ($this->_tree[$index]['children'] as $child) {
                        $this->printTree($child);
                    }
                ?></ul><?php
            }
        ?></li><?php
    }
}

<?php
class RightsTree
{
    protected $_tree;
 
    public function __construct($expression) {
        $this->_tree = $this->buildTree($expression);
    }
 
    protected function buildTree($input) {
        $tree           = array();          // result array
        $freeSpots      = array(0 => 1);    // depth => number of free spots
        $parents        = array();          // stack with indexes of $tree which are parents
        $currentDepth   = 0;
 
        // list of tokens that will create new free spots at a (one) lower level
        $newSpots = array(
            '&' => 2,
            '|' => 2,
            '!' => 1,
        );
        // mapping to a more readable form
        $map = array(
            '&' => 'AND',
            '|' => 'OR',
            '!' => 'NOT',
        );
        foreach (explode(',', $input) as $position => $token) {
            // find highest level at which there are free spots
            $spotFound = false;
            $d = count($freeSpots) - 1;
            while ($d > -1 && $spotFound === false) {
                if ($freeSpots[$d] > 0) {
                    $currentDepth = $d;
                    $spotFound = true;
                } else {
                    array_pop($freeSpots); // do not inspect this level again (also to prevent popping too many elements from $parents)
                    array_pop($parents); // this parent no longer has any free spots
                    $d--; // look one level lower
                }
            }
 
            if ($spotFound === false) {
                // complain, e.g. throw exception
                die('malformed expression at position '.$position);
            }
 
            // add token to tree
            $parent = (count($parents) ? $parents[count($parents)-1] : -1);
            $tree[] = array(
                'parent'    => $parent,
                'children'  => array(),
                'value'     => (array_key_exists($token, $map) ? $map[$token] : $token),
            );
            if ($parent > -1) {
                $tree[$parent]['children'][] = count($tree) - 1; // index of the element we just added
            }
 
            // subtract free spots
            $freeSpots[$currentDepth] -= 1;
 
            // is this a token that creates new spots?
            if (array_key_exists($token, $newSpots)) {
                // add number of free spots defined in $spots
                $freeSpots[$currentDepth+1] = $newSpots[$token];
                // this is a new parent
                $parents[] = count($tree) - 1; // index of the element we just added
            }
        } // foreach
        return $tree;
    }
 
    public function printTree($index=0) {
        // @todo add output escaping
        ?><li><span><?php echo $this->_tree[$index]['value']; ?></span><?php
            if (count($this->_tree[$index]['children'])) {
                ?><ul><?php
                    foreach ($this->_tree[$index]['children'] as $child) {
                        $this->printTree($child);
                    }
                ?></ul><?php
            }
        ?></li><?php
    }
}

<?php
$input = '&,|,&,D,E,C,!,|,A,B'; // assumption: this expression was validated successfully earlier
$tree = new RightsTree($input);
?><ul id="tree"><?php
    $tree->printTree();
?></ul>

<?php
$input = '&,|,&,D,E,C,!,|,A,B'; // assumption: this expression was validated successfully earlier
$tree = new RightsTree($input);
?><ul id="tree"><?php
    $tree->printTree();
?></ul>

$html.keypress(function(e) {
    if (e.which == 13) {
        // do not submit form...
        e.preventDefault();
        // ... but trigger blur() event instead
        $(this).blur();
    }
});

$html.keypress(function(e) {
    if (e.which == 13) {
        // do not submit form...
        e.preventDefault();
        // ... but trigger blur() event instead
        $(this).blur();
    }
});

$html.focus().select();

$html.focus().select();

DELIMITER ;;
DROP FUNCTION IF EXISTS has_rights;;
CREATE FUNCTION has_rights(expression VARCHAR(255), rights VARCHAR(255)) RETURNS BOOL DETERMINISTIC
BEGIN
    DECLARE stack VARCHAR(255);
    DECLARE token VARCHAR(5);
    DECLARE val1 VARCHAR(5);
    DECLARE val2 VARCHAR(5);
    IF (expression = '') THEN
        RETURN TRUE;
    END IF;
    SET stack = '1,';
    SET expression = REVERSE(CONCAT(',&,', expression));
    WHILE (LOCATE(',', expression) > 0) DO
        SET token      = REVERSE(SUBSTRING_INDEX(expression, ',', 1));
        SET expression = SUBSTRING(expression, LENGTH(token) + 2);
        IF (LENGTH(token) > 0) THEN
            IF (token = '|' OR token = '&') THEN
                SET val1 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = SUBSTRING(stack, LENGTH(val1) + 2);
                SET val2 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = SUBSTRING(stack, LENGTH(val2) + 2);
                IF (token = '|') THEN
                    SET stack = CONCAT((val1 OR val2), ',', stack);
                ELSE
                    SET stack = CONCAT((val1 AND val2), ',', stack);
                END IF;
            ELSEIF (token = '!') THEN
                SET val1 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = CONCAT(NOT(val1), ',', SUBSTRING(stack, LENGTH(val1) + 2));
            ELSE
                SET val1 = LOCATE(CONCAT(',', token, ','), CONCAT(',', rights, ',')) > 0;
                SET stack = CONCAT(val1, ',', stack);
            END IF;
        END IF;
    END WHILE;
    SET val1 = SUBSTRING_INDEX(stack, ',', 1);
    RETURN (val1 = 1);
END;;
DELIMITER ;

DELIMITER ;;
DROP FUNCTION IF EXISTS has_rights;;
CREATE FUNCTION has_rights(expression VARCHAR(255), rights VARCHAR(255)) RETURNS BOOL DETERMINISTIC
BEGIN
    DECLARE stack VARCHAR(255);
    DECLARE token VARCHAR(5);
    DECLARE val1 VARCHAR(5);
    DECLARE val2 VARCHAR(5);
    IF (expression = '') THEN
        RETURN TRUE;
    END IF;
    SET stack = '1,';
    SET expression = REVERSE(CONCAT(',&,', expression));
    WHILE (LOCATE(',', expression) > 0) DO
        SET token      = REVERSE(SUBSTRING_INDEX(expression, ',', 1));
        SET expression = SUBSTRING(expression, LENGTH(token) + 2);
        IF (LENGTH(token) > 0) THEN
            IF (token = '|' OR token = '&') THEN
                SET val1 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = SUBSTRING(stack, LENGTH(val1) + 2);
                SET val2 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = SUBSTRING(stack, LENGTH(val2) + 2);
                IF (token = '|') THEN
                    SET stack = CONCAT((val1 OR val2), ',', stack);
                ELSE
                    SET stack = CONCAT((val1 AND val2), ',', stack);
                END IF;
            ELSEIF (token = '!') THEN
                SET val1 = SUBSTRING_INDEX(stack, ',', 1);
                SET stack = CONCAT(NOT(val1), ',', SUBSTRING(stack, LENGTH(val1) + 2));
            ELSE
                SET val1 = LOCATE(CONCAT(',', token, ','), CONCAT(',', rights, ',')) > 0;
                SET stack = CONCAT(val1, ',', stack);
            END IF;
        END IF;
    END WHILE;
    SET val1 = SUBSTRING_INDEX(stack, ',', 1);
    RETURN (val1 = 1);
END;;
DELIMITER ;

mysql> SELECT has_rights('|,1,&,2,!,3', '1');
+--------------------------------+
| has_rights('|,1,&,2,!,3', '1') |
+--------------------------------+
|                              1 |
+--------------------------------+
1 row in set (0.00 sec) 

mysql> SELECT has_rights('|,1,&,2,!,3', '2');
+--------------------------------+
| has_rights('|,1,&,2,!,3', '2') |
+--------------------------------+
|                              1 |
+--------------------------------+
1 row in set (0.00 sec) 

mysql> SELECT has_rights('|,1,&,2,!,3', '2,3');
+----------------------------------+
| has_rights('|,1,&,2,!,3', '2,3') |
+----------------------------------+
|                                0 |
+----------------------------------+
1 row in set (0.00 sec)

mysql> SELECT has_rights('|,1,&,2,!,3', '1');
+--------------------------------+
| has_rights('|,1,&,2,!,3', '1') |
+--------------------------------+
|                              1 |
+--------------------------------+
1 row IN SET (0.00 sec) 
 
mysql> SELECT has_rights('|,1,&,2,!,3', '2');
+--------------------------------+
| has_rights('|,1,&,2,!,3', '2') |
+--------------------------------+
|                              1 |
+--------------------------------+
1 row IN SET (0.00 sec) 
 
mysql> SELECT has_rights('|,1,&,2,!,3', '2,3');
+----------------------------------+
| has_rights('|,1,&,2,!,3', '2,3') |
+----------------------------------+
|                                0 |
+----------------------------------+
1 row IN SET (0.00 sec)