a secure user authentication system (login/registration) with MySQL, PDO, and password hashing
تفاصيل العمل
<?php
// ==================== DATABASE SETUP ====================
$host = 'localhost';
$db = 'your_database';
$user = 'your_username';
$pass = 'your_password';
$charset = 'utf8mb4';
$dsn = "mysql:host=$host;dbname=$db;charset=$charset";
$options = [
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
PDO::ATTR_EMULATE_PREPARES => false,
];
try {
$pdo = new PDO($dsn, $user, $pass, $options);
} catch (PDOException $e) {
die("Database connection failed: " . $e->getMessage());
}
// ==================== FUNCTIONS ====================
function registerUser($pdo, $username, $password) {
// Validate input
if (empty($username) || empty($password)) {
return "Username and password are required!";
}
// Check if user exists
$stmt = $pdo->prepare("SELECT id FROM users WHERE username = ?");
$stmt->execute([$username]);
if ($stmt->fetch()) {
return "Username already taken!";
}
// Hash password and insert
$hashedPassword = password_hash($password, PASSWORD_BCRYPT);
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (?, ?)");
$stmt->execute([$username, $hashedPassword]);
return "Registration successful!";
}
function loginUser($pdo, $username, $password) {
// Fetch user
$stmt = $pdo->prepare("SELECT id, username, password FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch();
if (!$user || !password_verify($password, $user['password'])) {
return "Invalid credentials!";
}
// Start session
session_start();
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
return "Logged in as " . htmlspecialchars($user['username']);
}
function logoutUser() {
session_start();
session_destroy();
return "Logged out successfully!";
}
// ==================== HANDLE FORM SUBMISSIONS ====================
$message = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (isset($_POST['register'])) {
$message = registerUser($pdo, $_POST['username'], $_POST['password']);
} elseif (isset($_POST['login'])) {
$message = loginUser($pdo, $_POST['username'], $_POST['password']);
} elseif (isset($_POST['logout'])) {
$message = logoutUser();
}
}
// ==================== HTML UI ====================
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>PHP Auth Demo</title>
<style>
body { font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; }
.form-group { margin-bottom: 15px; }
button { padding: 8px 12px; background: #007bff; color: white; border: none; cursor: pointer; }
</style>
</head>
<body>
<h1>PHP Authentication System</h1>
<?php if (!empty($message)) echo "<p>$message</p>"; ?>
<?php if (empty($_SESSION['username'])): ?>
<h2>Register</h2>
<form method="POST">
<div class="form-group">
<input type="text" name="username" placeholder="Username" required>
</div>
<div class="form-group">
<input type="password" name="password" placeholder="Password" required>
</div>
<button type="submit" name="register">Register</button>
</form>
<h2>Login</h2>
<form method="POST">
<div class="form-group">
<input type="text" name="username" placeholder="Username" required>
</div>
<div class="form-group">
<input type="password" name="password" placeholder="Password" required>
</div>
<button type="submit" name="login">Login</button>
</form>
<?php else: ?>
<p>Welcome, <?= htmlspecialchars($_SESSION['username']) ?>!</p>
<form method="POST">
<button type="submit" name="logout">Logout</button>
</form>
<?php endif; ?>
</body>
</html>