Building a Complete Backend Project

CREATE DATABASE task_app;
USE task_app;

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) UNIQUE NOT NULL,
    password_hash VARCHAR(255) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE tasks (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL,
    task_name VARCHAR(255) NOT NULL,
    is_completed TINYINT(1) DEFAULT 0,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

<?php
// config.php
session_start();

$host = &#039;localhost';
$db   = &#039;task_app';
$user = &#039;root';
$pass = &#039;';

try {
    $pdo = new PDO("mysql:host=$host;dbname=$db", $user, $pass);
    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch (PDOException $e) {
    die("Database connection failed.");
}
?>

<?php
// auth.php
require &#039;config.php';

if ($_SERVER[&#039;REQUEST_METHOD'] == 'POST') {
    $action = $_POST[&#039;action']; // 'register' or 'login'
    $username = trim($_POST[&#039;username']);
    $password = $_POST[&#039;password'];

    if ($action == &#039;register') {
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = $pdo->prepare("INSERT INTO users (username, password_hash) VALUES (?, ?)");
        $stmt->execute([$username, $hash]);
        echo "Registration successful! Please login.";
    } 
    elseif ($action == &#039;login') {
        $stmt = $pdo->prepare("SELECT id, password_hash FROM users WHERE username = ?");
        $stmt->execute([$username]);
        $user = $stmt->fetch();

        if ($user && password_verify($password, $user[&#039;password_hash'])) {
            $_SESSION[&#039;user_id'] = $user['id'];
            header("Location: dashboard.php");
            exit;
        } else {
            echo "Invalid credentials.";
        }
    }
}
?>

<!-- Simple HTML Form -->
<h2>Register / Login</h2>
<form method="POST" action="auth.php">
    <input type="text" name="username" placeholder="Username" required>
    <input type="password" name="password" placeholder="Password" required>
    <button type="submit" name="action" value="login">Login</button>
    <button type="submit" name="action" value="register">Register</button>
</form>

<?php
// dashboard.php
require &#039;config.php';

// Access Control
if (!isset($_SESSION[&#039;user_id'])) {
    header("Location: auth.php");
    exit;
}

$user_id = $_SESSION[&#039;user_id'];

// Handle Task Creation
if ($_SERVER[&#039;REQUEST_METHOD'] == 'POST' && isset($_POST['new_task'])) {
    $task_name = htmlspecialchars($_POST[&#039;task_name']);
    $stmt = $pdo->prepare("INSERT INTO tasks (user_id, task_name) VALUES (?, ?)");
    $stmt->execute([$user_id, $task_name]);
}

// Handle Task Deletion
if (isset($_GET[&#039;delete'])) {
    $task_id = $_GET[&#039;delete'];
    // SECURITY: Ensure the task being deleted belongs to the logged-in user!
    $stmt = $pdo->prepare("DELETE FROM tasks WHERE id = ? AND user_id = ?");
    $stmt->execute([$task_id, $user_id]);
}

// Read Tasks
$stmt = $pdo->prepare("SELECT * FROM tasks WHERE user_id = ?");
$stmt->execute([$user_id]);
$tasks = $stmt->fetchAll(PDO::FETCH_ASSOC);
?>

<h1>My Tasks</h1>
<a href="logout.php">Log Out</a>

<!-- CREATE FORM -->
<form method="POST">
    <input type="text" name="task_name" required>
    <button type="submit" name="new_task">Add Task</button>
</form>

<!-- READ / DELETE UI -->
<ul>
    <?php foreach ($tasks as $t): ?>
        <li>
            <?php echo $t[&#039;task_name']; ?> 
            <a href="?delete=<?php echo $t[&#039;id']; ?>" style="color:red;">[X]</a>
        </li>
    <?php endforeach; ?>
</ul>