PHP Authentication System

# Chapter 23: PHP Authentication System

1. Introduction #

2. Learning Objectives #

• Understand the concept of one-way Password Hashing.

• Securely hash passwords using password_hash().

• Verify user passwords using password_verify().

• Build a Registration script to save new users.

• Build a Login script that creates a secure Session.

• Protect pages so only logged-in users can view them.

3. The Golden Rule of Passwords #

4. Password Hashing in PHP #

<?php
$user_password = "mypassword123";

// Generate the hash
$hashed_password = password_hash($user_password, PASSWORD_DEFAULT);

echo $hashed_password; 
// Outputs something like: $2y$10$U5.8tH/... random 60 character string
?>

5. Password Verification #

<?php
$attempted_password = "mypassword123";
// $hashed_password is the string we pulled from the database

if (password_verify($attempted_password, $hashed_password)) {
    echo "Login successful!";
} else {
    echo "Incorrect password.";
}
?>

6. Building the Registration System #

CREATE TABLE accounts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL
);

Now, the PHP logic for register.php:

<?php
require &#039;db.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = trim($_POST[&#039;username']);
    $password = $_POST[&#039;password'];

    // 1. Hash the password
    $hash = password_hash($password, PASSWORD_DEFAULT);

    // 2. Insert into database using Prepared Statements
    $sql = "INSERT INTO accounts (username, password_hash) VALUES (:username, :hash)";
    $stmt = $pdo->prepare($sql);
    
    try {
        $stmt->execute([&#039;:username' => $username, ':hash' => $hash]);
        echo "Registration successful! You can now log in.";
    } catch (PDOException $e) {
        echo "Error: Username might already exist.";
    }
}
?>
<!-- Basic Registration Form -->
<form method="POST">
    <input type="text" name="username" required>
    <input type="password" name="password" required>
    <button type="submit">Register</button>
</form>

7. Building the Login System #

<?php
session_start();
require &#039;db.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = trim($_POST[&#039;username']);
    $password = $_POST[&#039;password'];

    // 1. Fetch user from database
    $stmt = $pdo->prepare("SELECT * FROM accounts WHERE username = :username");
    $stmt->execute([&#039;:username' => $username]);
    $user = $stmt->fetch();

    // 2. Verify user exists AND password is correct
    if ($user && password_verify($password, $user[&#039;password_hash'])) {
        // 3. Create Session!
        $_SESSION[&#039;user_id'] = $user['id'];
        $_SESSION[&#039;username'] = $user['username'];
        
        echo "Logged in! Welcome to your dashboard.";
        // Usually, you redirect here: header("Location: dashboard.php");
    } else {
        echo "Invalid username or password.";
    }
}
?>
<form method="POST">
    <input type="text" name="username" required>
    <input type="password" name="password" required>
    <button type="submit">Login</button>
</form>

8. Protecting Pages #

<?php
session_start();

// If the session does not exist, kick them out!
if (!isset($_SESSION[&#039;user_id'])) {
    header("Location: login.php");
    exit(); // Crucial to stop the rest of the page from loading
}

echo "Welcome to the secure area, " . $_SESSION[&#039;username'];
?>

9. Output Explanations #

10. Common Mistakes #

• Setting the DB password column too short: password_hash() creates a string up to 60-255 characters long. If your MySQL table column is VARCHAR(50), the hash will be cut off, and password_verify will ALWAYS fail. Always use VARCHAR(255) for password columns.

• Using MD5 or SHA1: Never use md5($password). These are ancient hashing algorithms that can be cracked in milliseconds using modern graphics cards.

• Forgetting exit(); after a header redirect: If you redirect an unauthorized user but forget exit();, the PHP script continues running on the server, executing sensitive code silently!

11. Best Practices #

• Always trim whitespace from usernames/emails during login and registration.

• Give generic error messages ("Invalid credentials") rather than specific ones ("Password incorrect").

12. Exercises #

1. 1. Set up the accounts table in your database.

1. 2. Combine the registration and login code above into two separate working files.

1. 3. Register an account, verify the hash in phpMyAdmin, and successfully log in.

13. Mini Project: Complete Login/Register System #

14. MCQs with Answers #

2. Why is exit() necessary after sending a Location header redirect? A) To close the database connection. B) To stop the current script from continuing to execute code in the background. C) To force the browser to refresh. D) It is not necessary. *Answer: B*

3. If a user forgets their password, can you use PHP to un-hash it and email it to them? A) Yes, using password_unhash(). B) No. Hashing is a one-way mathematical function. You must generate a secure password reset link instead. C) Yes, if you have the secret server key. D) Only if you use md5. *Answer: B*

15. Interview Questions #

Q: Explain how to properly restrict access to a PHP page. *A:* Start the session (session_start()). Check if a specific session variable (like $_SESSION['user_id']) is set. If it is not isset(), immediately send an HTTP redirect header (header("Location: login.php")) and instantly terminate the script using exit().

16. FAQs #

17. Summary #

18. Next Chapter Recommendation #