The login system enables users to create and log in to their accounts, allowing them to access website content. The login system is a key feature for every membership website. If you want to restrict access to the website content and allow only the logged-in user to access the content, user login functionality needs to be implemented. User registration and login system<\/b> can be integrated easily with PHP and MySQL. In this tutorial, we\u2019ll show you how to build a secure login system with PHP and MySQL.<\/p>\n
In this PHP Login System with MySQL<\/b> (user authentication) script, we will implement the following features:<\/p>\n Before getting started to build User Login System with PHP<\/b>, take a look at the complete file structure of the project.<\/p>\n Create a MySQL database (ex: This file is used to set database connection parameters. Update the database configuration according to your MySQL setup. Also, set the base URL and mail settings for password recovery.<\/p>\n There are also helper functions to connect to the database and sanitize user input.<\/p>\n This file contains the user registration form and handles the registration process. It includes input validation, password hashing, and storing user details in the database. It also checks for duplicate email addresses to prevent multiple registrations with the same email.<\/p>\n\n
login_system_with_php\/<\/span>\r\n\u251c\u2500\u2500 config.php\r\n\u251c\u2500\u2500 index.php\r\n\u251c\u2500\u2500 register.php\r\n\u251c\u2500\u2500 forgot.php\r\n\u251c\u2500\u2500 reset.php\r\n\u251c\u2500\u2500 account.php\r\n\u251c\u2500\u2500 logout.php\r\n\u2514\u2500\u2500 assets\/<\/span>\r\n \u2514\u2500\u2500 style.css\r\n<\/pre>\nCreate Database Table<\/h2>\n
codexworld_db<\/code>) and a table named users<\/code> using the following SQL query. The users<\/code> table includes fields for user details such as first name, last name, email, password, and created date.<\/p>\nCREATE<\/span> TABLE<\/span> `users`<\/span> (\r\n `id`<\/span> INT<\/span> UNSIGNED<\/span> NOT<\/span> NULL<\/span> AUTO_INCREMENT,\r\n `first_name`<\/span> VARCHAR<\/span>(50<\/span>) NOT<\/span> NULL<\/span>,\r\n `last_name`<\/span> VARCHAR<\/span>(50<\/span>) NOT<\/span> NULL<\/span>,\r\n `email`<\/span> VARCHAR<\/span>(100<\/span>) NOT<\/span> NULL<\/span> UNIQUE<\/span>,\r\n `password`<\/span> VARCHAR<\/span>(255<\/span>) NOT<\/span> NULL<\/span>,\r\n `reset_token`<\/span> VARCHAR<\/span>(255<\/span>) DEFAULT<\/span> NULL<\/span>,\r\n `reset_expires`<\/span> DATETIME DEFAULT<\/span> NULL<\/span>,\r\n `created_at`<\/span> TIMESTAMP<\/span> DEFAULT<\/span> CURRENT_TIMESTAMP<\/span>,\r\n PRIMARY KEY<\/span> (`id`<\/span>)\r\n) ENGINE<\/span>=InnoDB<\/span> DEFAULT<\/span> CHARSET<\/span>=utf8mb4;<\/pre>\nDatabase Configuration (config.php)<\/h2>\n
\n
DB_HOST<\/code>, DB_USER<\/code>, DB_PASS<\/code>, and DB_NAME<\/code> constants, set the database connection parameters according to your MySQL setup.<\/li>\nBASE_URL<\/code> constant, set the base URL according to your project path.<\/li>\nMAIL_FROM<\/code> constant, set the email address from which password reset emails will be sent.<\/li>\n<\/ul>\n<?php
<\/span>\/\/ Database configuration (adjust according to your mySQL setup)
<\/span>define<\/span>(<\/span>'DB_HOST'<\/span>, <\/span>'localhost'<\/span>);
<\/span>define<\/span>(<\/span>'DB_USER'<\/span>, <\/span>'root'<\/span>);
<\/span>define<\/span>(<\/span>'DB_PASS'<\/span>, <\/span>'root_pass'<\/span>);
<\/span>define<\/span>(<\/span>'DB_NAME'<\/span>, <\/span>'codexworld_db'<\/span>);
<\/span>\/\/ Base URL (adjust if necessary)
<\/span>define<\/span>(<\/span>'BASE_URL'<\/span>, <\/span>'http:\/\/localhost\/secure_login_system_with_php\/'<\/span>);
<\/span>\/\/ Mail settings: when using localhost, ensure a mailer is configured or use SMTP in production
<\/span>define<\/span>(<\/span>'MAIL_FROM'<\/span>, <\/span>'no-reply@example.com'<\/span>);
<\/span>\/\/ Start session
<\/span>if (<\/span>session_status<\/span>() === <\/span>PHP_SESSION_NONE<\/span>) {
<\/span>session_start<\/span>();
}
<\/span>\/\/ Create mysqli connection
<\/span>function <\/span>db_connect<\/span>() {
<\/span>$mysqli <\/span>= new <\/span>mysqli<\/span>(<\/span>DB_HOST<\/span>, <\/span>DB_USER<\/span>, <\/span>DB_PASS<\/span>, <\/span>DB_NAME<\/span>);
if (<\/span>$mysqli<\/span>-><\/span>connect_errno<\/span>) {
die(<\/span>'Database connection failed: ' <\/span>. <\/span>$mysqli<\/span>-><\/span>connect_error<\/span>);
}
<\/span>\/\/ set charset
<\/span>$mysqli<\/span>-><\/span>set_charset<\/span>(<\/span>'utf8mb4'<\/span>);
return <\/span>$mysqli<\/span>;
}
<\/span>\/\/ Helper: sanitize input
<\/span>function <\/span>e<\/span>(<\/span>$str<\/span>) {
return <\/span>htmlspecialchars<\/span>(<\/span>$str<\/span>, <\/span>ENT_QUOTES<\/span>, <\/span>'UTF-8'<\/span>);
}
<\/span>?><\/span><\/pre>\nRegistration Page (register.php)<\/h2>\n
\n
\n
password_hash()<\/code> and the user details are inserted into the database using prepared statements to prevent SQL injection.<\/li>\n<\/ul>\n<\/li>\n<?php
<\/span>\/\/ Include configuration file
<\/span>require_once <\/span>'config.php'<\/span>;
<\/span>\/\/ If already logged in, redirect to account
<\/span>if (!empty(<\/span>$_SESSION<\/span>[<\/span>'user_id'<\/span>])) {
<\/span>header<\/span>(<\/span>'Location: account.php'<\/span>);
exit;
}
<\/span>\/\/ Initialize
<\/span>$errors <\/span>= [];
<\/span>$old <\/span>= [<\/span>'first_name'<\/span>=><\/span>''<\/span>,<\/span>'last_name'<\/span>=><\/span>''<\/span>,<\/span>'email'<\/span>=><\/span>''<\/span>];
<\/span>\/\/ Handle form submission
<\/span>if (<\/span>$_SERVER<\/span>[<\/span>'REQUEST_METHOD'<\/span>] === <\/span>'POST' <\/span>&& isset(<\/span>$_POST<\/span>[<\/span>'submit'<\/span>])) {
<\/span>$first <\/span>= <\/span>trim<\/span>(<\/span>$_POST<\/span>[<\/span>'first_name'<\/span>] ?? <\/span>''<\/span>);
<\/span>$last <\/span>= <\/span>trim<\/span>(<\/span>$_POST<\/span>[<\/span>'last_name'<\/span>] ?? <\/span>''<\/span>);
<\/span>$email <\/span>= <\/span>trim<\/span>(<\/span>$_POST<\/span>[<\/span>'email'<\/span>] ?? <\/span>''<\/span>);
<\/span>$password <\/span>= <\/span>$_POST<\/span>