The article researches models based on RBAC,and then introduces several design principles,aiming to solve the security problems of a web system.Finally,the article designs an extended privilege management model in a real project using the structure of FleaPHP.