Php Programming Code Examples

Php > Authentication Code Examples

Complete, simple, working example of a login screen system using php

Complete, simple, working example of a login screen system using php
functions, cookies, and a mysql database for begginers.

<? 
// This first if statement checks to see if we have a username/pass submited by the form, if it does then it attempts to validate it. 
if($username && $password) { 
  mysql_connect() or die ("Whoops");    // Connect to the database, or if connection fails print error message. 
  $password = md5($password);          // encode submited password with MD5 encryption and store it back in the same variable. If not on a windows box, I 
suggest you use crypt() 
  $sql = "select * from login where username='$username'";   // query statment that gets the username/password from 'login' where the username is the same as 
the one you 
submited 
  $r = mysql_db_query("register",$sql);  // Execute Query 

  // if no rows for that database come up, redirect. 
  if(!mysql_num_rows($r)) 
    header("Location: $SCRIPT_NAME");  // This is the redirection, notice it uses $SCRIPT_NAME which is a predefined variable with the name of the script in it. 

  $user = mysql_fetch_array($r);  // if we got passed the last if statment means we have a registered username, get the rest of the info and put it in an array 
named $user 
  if($user["password"] == $password) {   // If the password stored in the database is the same as the password the user entered (which is now encryped with MD5) 
    $password = serialize($password);  // if we get this far we know we have a registered username, and the password matches. 
                                                      // serialize() the already incrypted password just for fun and mabey some extra security for when we 
store it in a cookie 
    setcookie("candle_login","$username $password");  // Set the cookie named 'candle_login' with the value of the username (in plain text) and the password 
(which has been 
encrypted and serialized.) 

// set variable $msg with an HTML statement that basically says redirect to the next page. The reason we didn't use header() is that using setcookie() and 
header() at the same 
time isn't 100% compatible with all browsers, this is more compatible. 

    $msg = "<meta http-equiv=\"Refresh\" content=\"0;url=./nextpage.php\">"; 
  }else{ 
     header("Location: $SCRIPT_NAME");  //If the password didn't match, redirect to this page in which $username and $password are reset therefore the first if 
() never gets executed 
  } 
} 
if($msg) echo $msg;  //if $msg is set echo it, resulting in a redirect to the next page. 
?> 

// This is the login screen 
<html> 
<title>Login</title> 
<body bgcolor="yellow" text="black"> 
<form method="post" action="<?echo $SCRIPT_NAME;?>"> // submit form data to this page 

<center><font size=+5><b>Welcome!</b></font></center> 
<br> 
<br> 
<br> 
<table cellspacing=0 cellpadding=0 width=320 align="center"> 
<tr><td> 
Username: 
</td><td> 
<input name="username" type="text" width=10> 
</td></tr> 
<tr><td> 
Password: 
</td><td> 
<input name="password" type="password" width=10> 
</td></tr> 
<tr><td colspan=2 align="center"> 
<input name="login" type="submit"> 
</td></tr> 
</table> 
</form> 
</html> 


/* That was the login page 
    Next is some code you can put into a different file (named 'login_check.inc' or something) 
    that you include() on each page you want protected on your site. 
    It uses the cookie from the first script to verify user has already been there. 
*/ 

<? 
// if the cookie doesn't exsist means the user hasn't been verified by the login page so send them back to the login page. 
if(!$candle_login) 
  header("Location: ./login.php"); 

if($phpcoders) {     // if the cookie does exsist 
  mysql_connect() or die ("Whoops");  //connect to db 
  $user = explode(" ","$phpcoders");   //explode cookie value (which is the '$username $password (note seperated by space)) and store values in $user. Check 
manual for more info 
on explode() 

  $sql = "select * from login where username='$user[0]'";  //sql statment that uses the username from the cookie. 
  $r = mysql_db_query("register",$sql);  //execute sql 

  if(!mysql_num_rows($r)) {    // if there are no rows, means no matches for that username 
    header("Location: ./login.php");   // so go back to the login page 
  } 

  $chkusr = mysql_fetch_array($r); //if we got passed the last part, then get the username/password set that match that username 
  if(unserialize($user[1]) != $chkusr[1]) //if the password from cookie (notice we have to unserialize it) doesn't match the one from the database 
    header("Location: ./login.php");       // go back to the login page 
}                                                     // if it did match then continue on to page and this ends up doing nothing :) 
?>