This is my code:

        /**
         * This method check for user authorization to an app
         *
         * @param AccessCheck $accessCheck - The app and user credentials
         *
         * @return array user authorization
         */
        public function CheckAccess(AccessCheck $accessCheck) {
            $sql = "SELECT grade, department FROM acl WHERE app=:app";
            $stmt = $this->connection->prepare($sql);
            $stmt->execute(['app' => $accessCheck->app]);
            $access = $stmt->fetch();
            var_dump($access);
            var_dump($access['grade']);
            var_dump((int) $accessCheck->grade - 1);
            var_dump(substr($access['grade'], (int) $accessCheck->grade - 1,1));
            var_dump(substr($access['department'], (int) $accessCheck->department - 1,1));
            if(substr($access['grade'], (int) $accessCheck->grade - 1,1) == "1") {
                return "Granted";
            } else {
                if((substr($access['grade'], (int) $accessCheck->grade - 1, 1) == "1") && (substr($access['department'], (int) $accessCheck->department - 1, 1) == "1")) {
                    return "Granted";
                } else {
                    return "Denied";
                }
            }
        }

This is what postman outputs:

C:\Users\tlmar\Documents\GitHub\Phoenix-API\src\Domain\Repository\Security.php:109:
array (size=2)
  'grade' => string '1000' (length=4)
  'department' => string '010000' (length=6)
C:\Users\tlmar\Documents\GitHub\Phoenix-API\src\Domain\Repository\Security.php:110:string '1000' (length=4)
C:\Users\tlmar\Documents\GitHub\Phoenix-API\src\Domain\Repository\Security.php:111:int 0
C:\Users\tlmar\Documents\GitHub\Phoenix-API\src\Domain\Repository\Security.php:112:string '1' (length=1)
C:\Users\tlmar\Documents\GitHub\Phoenix-API\src\Domain\Repository\Security.php:113:string '0' (length=1)
{"success":true,"message":"User Access determined.","data":"Granted"}

The grade and department strings are show above. If they are both a 1 I want to return granted, if not it needs to return denied.