A login system is one of the most important features of any web application. Whether you’re building an admin panel, an eCommerce website, or a blog, users need a secure way to sign in.
In this tutorial, you’ll learn how to create a secure PHP Login System using MySQL. We’ll cover database creation, login form, session management, password verification, and security best practices.
What is a PHP Login System?
A PHP Login System allows users to authenticate themselves using an email address or username and a password. After successful authentication, PHP creates a session so the user remains logged in while browsing the website.
Before creating a login system, you should know how to connect PHP with MySQL .
Prerequisites
Before creating a login system, make sure you have:
- PHP installed
- MySQL database
- Apache or Nginx server
- Basic knowledge of HTML forms
Database Table
Create a table named users.
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
name VARCHAR(100),
email VARCHAR(150) UNIQUE,
password VARCHAR(255)
);Database Connection
<?php
$conn = new mysqli("localhost","root","","mydatabase");
if($conn->connect_error){
die("Connection Failed");
}
?>Login Form
<form method="POST">
<input
type="email"
name="email"
placeholder="Email Address"
required>
<input
type="password"
name="password"
placeholder="Password"
required>
<button type="submit">
Login
</button>
</form>Login PHP Code
<?php
session_start();
$email=$_POST['email'];
$password=$_POST['password'];
$stmt=$conn->prepare("SELECT id,name,password FROM users WHERE email=?");
$stmt->bind_param("s",$email);
$stmt->execute();
$result=$stmt->get_result();
if($result->num_rows>0){
$user=$result->fetch_assoc();
if(password_verify($password,$user['password'])){
$_SESSION['user_id']=$user['id'];
$_SESSION['user_name']=$user['name'];
header("Location: dashboard.php");
exit;
}else{
echo "Invalid Password";
}
}else{
echo "User Not Found";
}
?>Dashboard Protection
<?php
session_start();
if(!isset($_SESSION['user_id'])){
header("Location: login.php");
exit;
}
?>This ensures only logged-in users can access protected pages.
Logout Script
<?php
session_start();
session_destroy();
header("Location: login.php");
exit;
?>Password Hashing
Never store passwords in plain text.
$password=password_hash($password,PASSWORD_DEFAULT);To verify:
password_verify($password,$hashedPassword);Security Best Practices
- Always hash passwords using
password_hash(). - Use prepared statements for every database query.
- Validate and sanitize user input.
- Use HTTPS in production.
- Regenerate session IDs after login.
- Never display database errors to users.
Common Mistakes
- Saving plain-text passwords.
- Using SQL queries without prepared statements.
- Forgetting
session_start(). - Not validating email addresses.
- Allowing unlimited login attempts.
Conclusion
A secure PHP Login System is the foundation of most web applications. By using sessions, prepared statements, and password hashing, you can build a login system that is both secure and reliable.
Frequently Asked Questions
Is PHP good for login systems?
Yes. PHP provides built-in session management and password hashing functions that make it easy to create secure authentication systems.
Why should I use password_hash()?
It stores passwords securely using modern hashing algorithms, making them difficult to crack.
What is password_verify()?
It compares a plain-text password with the hashed password stored in the database.
Why are prepared statements important?
Prepared statements protect your application against SQL injection attacks.
Can I use usernames instead of email addresses?
Yes. You can authenticate users using either usernames or email addresses depending on your application’s requirements.