User Authentication and Login Systems

# CHAPTER 10

User Authentication and Login Systems #

1. Introduction #

2. Learning Objectives #

• Understand the extreme danger of storing plain-text passwords.

• Use password_hash() to securely encrypt passwords.

• Use password_verify() during the login process.

• Implement strict access control to protect private web pages.

3. Beginner-Friendly Explanation #

4. The Golden Rule: Never Store Plain-Text Passwords #

5. Registration (Hashing the Password) #

<?php
require &#039;db.php';

// Data from Registration Form
$email = $_POST[&#039;email'];
$raw_password = $_POST[&#039;password'];

// Hash the password securely
$hashed_password = password_hash($raw_password, PASSWORD_DEFAULT);

// Insert into Database using Prepared Statements
$sql = "INSERT INTO users (email, password) VALUES (?, ?)";
$stmt = $pdo->prepare($sql);
$stmt->execute([$email, $hashed_password]);

echo "Registration successful!";
?>

*Now, the database stores something like:* $2y$10$w8T.G3b1Gq4...

6. Login (Verifying the Password) #

<?php
session_start();
require &#039;db.php';

$login_email = $_POST[&#039;email'];
$login_password = $_POST[&#039;password'];

// 1. Find the user by email
$sql = "SELECT id, password FROM users WHERE email = ?";
$stmt = $pdo->prepare($sql);
$stmt->execute([$login_email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

// 2. Verify password AND check if user actually exists
if ($user && password_verify($login_password, $user[&#039;password'])) {
    
    // Passwords match! Log them in via Sessions
    $_SESSION[&#039;user_id'] = $user['id'];
    $_SESSION[&#039;logged_in'] = true;
    
    echo "Login successful! Redirecting to dashboard...";
    // header("Location: dashboard.php");
    
} else {
    // Vague error message prevents hackers from knowing if the email exists
    echo "Invalid email or password."; 
}
?>

7. Access Control (Protecting Pages) #

At the very top of dashboard.php:

<?php
session_start();

// If the session variable is NOT set, they are an intruder
if (!isset($_SESSION[&#039;logged_in']) || $_SESSION['logged_in'] !== true) {
    // Redirect them to the public login page
    header("Location: login.php");
    exit; // Stop the rest of the script from executing!
}

// If they pass the check, show the private page
echo "<h1>Welcome to the secure dashboard!</h1>";
?>

8. The Logout Script #

<?php
session_start();
$_SESSION = array(); // Empty the array
session_destroy();   // Destroy the session
header("Location: index.php");
exit;
?>

9. Best Practices #

• Vague Error Messages: During login, never say "Password incorrect" or "Email not found." This tells hackers exactly which emails exist in your database, allowing them to target specific accounts. Always use: "Invalid credentials."

10. Common Mistakes #

• Forgetting exit; After a Redirect: When you use header("Location: login.php"); to kick out an intruder, the server sends the redirect header, *but it keeps executing the rest of the PHP file in the background!* A hacker can use software to ignore the redirect and scrape the private HTML data. You must ALWAYS put exit; immediately after a redirect.

11. Exercises #

1. 1. Explain why developers use password_hash() rather than two-way encryption algorithms that allow passwords to be decrypted back to plain text.

12. Coding Challenges #

• Challenge: Modify the Access Control script to check a user's role. If $_SESSION['role'] is not equal to 'Admin', redirect them to a page called access_denied.php.

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the modern PHP registration and login workflow. Specifically, how do password_hash() and password_verify() interact?

• Q: What is the purpose of an "Access Control" block at the top of a private PHP file, and how does it utilize $_SESSION?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #