Create a secure login form using html with POST method and csrf protection. 2. Sanitize inputs in php using filter_input() or htmlspecialchars(). 3. Connect to mysql securely via pdo with credentials stored outside web root. 4. Use prepared statements to query user data and verify passwords with password_verify(). 5. Start session upon success, set session variables, and regenerate session ID. 6. Protect pages by checking session status and redirecting unauthorized users. 7. Implement logout via session_destroy() to clear all session data.
To implement a login system in PHP, you need to handle user authentication securely. Here’s how to create a functional and secure login feature:
The operating environment of this tutorial: macBook Pro, macOS Sonoma
1. Create a Login Form with HTML and PHP
This step involves building a simple front-end form that collects the user’s credentials and sends them to a PHP script for processing. The form should use the POST method to prevent credentials from appearing in the URL.
- Create an HTML file named login.html with fields for username and password
- Set the form action to a PHP file like authenticate.php
- Ensure the form includes CSRF protection via a hidden Token field
2. Validate User Input in PHP
Before processing any data, validate and sanitize user input to prevent injection attacks. This step ensures only properly formatted data moves forward in the authentication process.
立即学习“PHP免费学习笔记（深入）”；
- In authenticate.php, check if the request method is POST
- Use filter_input() or htmlspecialchars() to sanitize input
- Verify that both username and password fields are not empty
3. Connect to MySQL database Securely
A secure database connection is essential for retrieving user information. Use PDO or mysqli with prepared statements to avoid SQL injection vulnerabilities.
- Establish a connection using PDO and store credentials in environment variables or config files outside the web root
- Set Error mode to exception for better debugging: $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION)
- Keep the connection details such as host, username, password, and database name separate from the main script
4. Verify Credentials Using Password Hashing
User passwords must be stored using strong hashing algorithms like bcrypt. During login, compare the submitted password against the hashed version in the database using PHP’s password_verify() function.
- Query the database for the user by username using a prepared statement
- Fetch the stored hash and use password_verify($_POST[‘password’], $stored_hash)
- If verification fails, deny access and log the attempt for security monitoring
5. Start Session and Maintain User State
After successful authentication, start a PHP session to keep the user logged in across pages. This allows personalized content and access control on subsequent requests.
- Call session_start() at the beginning of authenticate.php
- Set session variables such as $_SESSION[‘user_id’] and $_SESSION[‘logged_in’] = true
- Regenerate session ID using session_regenerate_id() to prevent fixation attacks
6. Implement Access Control on protected Pages
For pages that require authentication, check the session status at the top of each script to ensure only authorized users can view the content.
- Add session_start() at the top of every protected page
- Check if $_SESSION[‘logged_in’] is true; otherwise, redirect to the login page
- Optionally verify additional attributes like role or permissions for granular access control
7. Log Out Functionality with Session Destruction
Provide a secure logout mechanism that destroys the session and clears sensitive data, ensuring the user is fully signed out.
- Create a logout.php file that calls session_start()
- Unset all session variables using $_SESSION = Array()
- Destroy the session with session_destroy() and redirect to the login page