[PHP] Basic Login Script With PHP

First, I accidently posted this to PHP Programming Help, and then realized I put it in the wrong forum. It's now been submitted to tutorials for review. Sorry about that.

This tutorial will attempt to teach you how to build a rudimentary login system for your site. It's assumed that you understand MySQL concepts, as well as session variables and form handling.


To begin, you will need to create a new table in your database named 'users'. In this database create three new fields 'id' (primary key), 'username', 'password'. You can add more fields as you need them later. For now we're just going to worry about checking for an existing username and password combination.

Next, create your html page with the login form. Below is a quick sample of a form you can build.

<form action="checkLogin.php" method="post"> <table> <tr> <td>Username: </td> </td><input type="text" name="user"></td> </tr> <tr> <td>Password: </td> <td><input type="password" name="pass"></td> </tr> </table> </form>

Please notice that we are using the POST method for the form. This is to ensure that the username and password aren't passed as URL parameters, which is a security flaw for obvious reasons.

Next we'll code our checkLogin.php page. This page is going to select all the rows with matching username and password combinations. There should only be one row that does so, which is our valid row. I'm not going to cover data integrity here, but you'll definitely want to sanitze your data from SQL injection. Keeping in the theme of my tutorials though, I only want to focus on the task at hand.

<?php // checkLogin.php session_start(); // Start a new session require('conn.php'); // Holds all of our database connection information // Get the data passed from the form $username = $_POST['user']; $password = $_POST['password']; // Do some basic sanitizing $username = stripslashes($username); $password = stripslashes($password); $sql = "select * from users where username = '$username' and password = '$password'"; $result = mysql_query($sql) or die ( mysql_error() ); $count = 0; while ($line = mysql_fetch_assoc($result)) { $count++; } if ($count == 1) { $_SESSION['loggedIn'] = "true"; header("Location: loginSuccess.php"); // This is wherever you want to redirect the user to } else { $_SESSION['loggedIn'] = "false"; header("Location: loginFailed.php"); // Wherever you want the user to go when they fail the login } ?>

You may want to consider posting the form to PHP_SELF for basic error handling, or you can pass error messages through the url parameter, it's up to you. As I said, this is just a rudimentary example of how to set up a basic user login script. From here, if you want to check and see if a user is logged in, just put the following at the top of a page.

<?php session_start(); if ($_SESSION['loggedIn'] != "true") { header("Location: http://www.whatever.com/login.php"); } ?>

Naturally there are many different ways to achieve the same thing in PHP. This script is great for basic logins, but may not be what you need for something more complex. Adapt it to your needs or just use it as a place to begin learning. Hope everything is clear with the instructions. As usual, questions and comments are more than welcome. Take care.


 Resource Program Here