How to Build a Simple Login System With PHP

Implementing a user login system is a foundational requirement for many web applications, from internal dashboards to client portals. For developers, marketers, and site owners, understanding the core mechanics of such a system built with PHP is crucial for both functionality and security. This guide outlines the essential components and steps to construct a simple, yet secure, login system using PHP and a relational database, focusing on practical implementation and critical safeguards against common vulnerabilities.

The decision to build a custom login system often stems from specific project needs that off-the-shelf solutions may not fully address, or from a desire for granular control over the authentication process. While frameworks abstract much of this complexity, a direct understanding of PHP-based authentication provides a solid foundation for debugging, customizing, and securing any web application that requires user access control.

Core Components of a PHP Login System

A functional login system relies on several interconnected parts working in concert. Each component plays a distinct role in managing user identities and access permissions.

Database Structure for Users

The bedrock of any login system is a database to store user information. A minimal users table typically includes:

• id: A unique primary key for each user, usually an auto-incrementing integer.
• username: A unique identifier for login, often an email address or a chosen username. This column should have a unique index.
• password_hash: Stores the securely hashed version of the user's password. Never store plain text passwords.
• created_at: A timestamp indicating when the user account was created.

Additional fields like email, first_name, last_name, or is_active can be added depending on application requirements, but the core three (id, username, password_hash) are indispensable for basic authentication.

User Registration Process

This involves collecting new user credentials and storing them securely. The process typically includes:

1. HTML Form: A web page with input fields for username, password, and password confirmation.
2. Server-Side Validation: PHP code that checks if inputs are present, meet complexity requirements (e.g., password length), and if the username is unique.
3. Password Hashing: Crucially, the submitted password is not stored directly but converted into an irreversible hash using functions like password_hash.
4. Database Insertion: The new user's username and password hash are then inserted into the users table.

User Login Authentication

Once registered, users need a mechanism to prove their identity:

1. HTML Form: Similar to registration, a form collects the username and password.
2. Database Lookup: PHP retrieves the stored password hash for the submitted username.
3. Password Verification: The submitted password is then hashed and compared against the stored hash using password_verify. This function is designed to safely compare a plain-text password against a hash.
4. Session Management: Upon successful verification, a server-side session is initiated to maintain the user's logged-in state across multiple page requests.

Session Management

PHP sessions are fundamental for maintaining state in stateless HTTP environments. When a user logs in, a unique session ID is generated and stored on the server, while a corresponding cookie is sent to the user's browser. This session stores variables (e.g., $_SESSION['user_id'], $_SESSION['username']) that identify the logged-in user. Every subsequent request from the user's browser sends back the session cookie, allowing the server to retrieve the associated session data and verify their authentication status.

Protecting Restricted Pages

Any page requiring user authentication must include a check at its beginning to ensure a valid session exists and the user is logged in. If not, the user is redirected to the login page or an access denied message is displayed. This gatekeeping mechanism prevents unauthorized access to sensitive content or functionalities.

Step-by-Step Implementation Guide

This section outlines the practical steps for constructing the login system, assuming a basic LAMP/LEMP stack (Linux, Apache/Nginx, MySQL, PHP) is in place.

Setting Up Your Environment

Ensure your web server (Apache or Nginx), PHP (version 7.4+ recommended for modern features and security), and MySQL/MariaDB are installed and configured. A local development environment like XAMPP, WAMP, or Docker can simplify this setup.

Database Creation and Table Schema

First, create a database (e.g., login_db) and the users table. Connect to your MySQL server and execute the following SQL:

CREATE DATABASE IF NOT EXISTS login_db;
USE login_db; CREATE TABLE IF NOT EXISTS users ( id INT AUTO_INCREMENT PRIMARY KEY, username VARCHAR(255) NOT NULL UNIQUE, password_hash VARCHAR(255) NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

The VARCHAR(255) for password_hash accommodates the length of hashes generated by password_hash, which are typically around 60 characters for Bcrypt.

Building the Registration Form

Create an register.php file with an HTML form. This form will submit data to a processing script.

<!-- register.php -->
<form action="register_process.php" method="post"> <label for="username">Username:</label> <input type="text" id="username" name="username" required><br> <label for="password">Password:</label> <input type="password" id="password" name="password" required><br> <label for="confirm_password">Confirm Password:</label> <input type="password" id="confirm_password" name="confirm_password" required><br> <button type="submit">Register</button>
</form>

Handling Registration Logic

The register_process.php script handles input validation, password hashing, and database insertion.

<?php
session_start;
// Database connection (e.g., using PDO)
$pdo = new PDO('mysql:host=localhost;dbname=login_db', 'your_user', 'your_password');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); if ($_SERVER['REQUEST_METHOD'] === 'POST') { $username = $_POST['username']; $password = $_POST['password']; $confirm_password = $_POST['confirm_password']; if ($password!== $confirm_password) { die("Passwords do not match."); } // Hash the password securely $password_hash = password_hash($password, PASSWORD_DEFAULT); try { $stmt = $pdo->prepare("INSERT INTO users (username, password_hash) VALUES (?,?)"); $stmt->execute([$username, $password_hash]); $_SESSION['message'] = "Registration successful! Please log in."; header("Location: login.php"); exit; } catch (PDOException $e) { if ($e->getCode == 23000) { // Duplicate entry for unique username die("Username already taken."); } die("Error: ". $e->getMessage); }
}?>

Creating the Login Form

Similar to registration, login.php provides the interface for user authentication.

<!-- login.php -->
<form action="login_process.php" method="post"> <label for="username">Username:</label> <input type="text" id="username" name="username" required><br> <label for="password">Password:</label> <input type="password" id="password" name="password" required><br> <button type="submit">Login</button>
</form>

Implementing Login Authentication

The login_process.php script verifies credentials and establishes a session.

<?php
session_start;
$pdo = new PDO('mysql:host=localhost;dbname=login_db', 'your_user', 'your_password');
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); if ($_SERVER['REQUEST_METHOD'] === 'POST') { $username = $_POST['username']; $password = $_POST['password']; $stmt = $pdo->prepare("SELECT id, username, password_hash FROM users WHERE username =?"); $stmt->execute([$username]); $user = $stmt->fetch(PDO::FETCH_ASSOC); if ($user && password_verify($password, $user['password_hash'])) { session_regenerate_id(true); // Prevent session fixation $_SESSION['user_id'] = $user['id']; $_SESSION['username'] = $user['username']; header("Location: dashboard.php"); exit; } else { $_SESSION['error'] = "Invalid username or password."; header("Location: login.php"); exit; }
}?>

Securing a Protected Page

For any page that requires a logged-in user, include this check at the very top:

<?php
session_start;
if (!isset($_SESSION['user_id'])) { header("Location: login.php"); exit;
}
// Page content for logged-in users
echo "Welcome, ". htmlspecialchars($_SESSION['username']). "!";?>

Adding a Logout Feature

A logout.php script terminates the user's session:

<?php
session_start;
session_unset; // Unset all session variables
session_destroy; // Destroy the session
header("Location: login.php"); // Redirect to login page
exit;?>

Essential Security Considerations

Even a "simple" login system demands robust security. Neglecting these can lead to severe data breaches and compromise user trust.

Password Hashing

Always use password_hash with PASSWORD_DEFAULT. This function uses a strong, adaptive hashing algorithm (currently Preventing SQL Injection

SQL injection occurs when malicious SQL code is inserted into input fields, potentially allowing attackers to read, modify, or delete database data. The examples provided use Session Hijacking Prevention

Session hijacking involves an attacker gaining access to a legitimate user's session. Key mitigations include: