How to Create Login Page in PHP and MySQL with Session

Submitted by GeePee on Monday, June 1, 2015 - 22:26.

How to Create Login Page in PHP and MySQL with Session In my previous tutorial called "How to Create Secure Login Page in PHP/MySQL", I explain on the three ways on how create a login page using PHP/MySQL. This time, I will add more functionality on this tutorial. We will add session so that we will know if the visitor has logged in on our site or not. In PHP, there is a variable called $_SESSION. Session allow you to store information and used it in any pages that you like. An example of this is storing of login information. If the visitor has logged in into your site, you can save the id and username of that particular visitor so you will not what privilege you can give to him/her. Unlike cookie, session is stored on the server. This means that session is more secure compare with cookie. Now let's begin creating our script. Create an html file called "login.html" and put the following code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Login Form</title>
</head>
 
<body>
<form id="form1" name="form1" method="post" action="login.php">
        <table width="510" border="0" align="center">
                <tr>
                        <td colspan="2">Login Form</td>
                </tr>
                <tr>
                        <td>Username:</td>
                        <td><input type="text" name="username" id="username" /></td>
                </tr>
                <tr>
                        <td>Password</td>
                        <td><input type="password" name="password" id="password" /></td>
                </tr>
                <tr>
                        <td>&nbsp;</td>
                        <td><input type="submit" name="button" id="button" value="Submit" /></td>
                </tr>
        </table>
</form>
</body>
</html>

Next, create a PHP file called "login.php" and put the following code:

<?php
ob_start();
session_start();
 
$username = $_POST['username'];
$password = $_POST['password'];
 
$conn = mysql_connect('localhost', 'root', '');
mysql_select_db('login', $conn);
 
$username = mysql_real_escape_string($username);
$query = "SELECT id, username, password, salt
        FROM member
        WHERE username = '$username';";
                
$result = mysql_query($query);
 
if(mysql_num_rows($result) == 0) // User not found. So, redirect to login_form again.
{
    header('Location: login.html');
}
 
$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
 
if($hash != $userData['password']) // Incorrect password. So, redirect to login_form again.
{
    header('Location: login.html');
}else{ // Redirect to home page after successful login.
        session_regenerate_id();
        $_SESSION['sess_user_id'] = $userData['id'];
        $_SESSION['sess_username'] = $userData['username'];
        session_write_close();
        header('Location: home.php');
}
?>

If you notice, we have added two line at the very top of the page. The lines are:

ob_start();
session_start();

It is very important to declare these two lines above of any code. Adding it below will not simply work. Take note also that we change the SQL statement on our previous tutorial. This is the line that has change:

$query = "SELECT id, username, password, salt
        FROM member
        WHERE username = '$username';";

And we added the following line after successful login:

        session_regenerate_id();
        $_SESSION['sess_user_id'] = $userData['id'];
        $_SESSION['sess_username'] = $userData['username'];
        session_write_close();

Next, create another PHP file called "home.php" and put the following code:

<?php
//Start session
session_start();
 
//Check whether the session variable SESS_MEMBER_ID is present or not
if(!isset($_SESSION['sess_user_id']) || (trim($_SESSION['sess_user_id']) == '')) {
        header("location: login.html");
        exit();
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Home Page</title>
</head>
 
<body>
<h1>Welcome, <?php echo $_SESSION["sess_username"] ?></h1>
</body>
</html>

We have also added session_start() function at the very top and check if the variable sess_user_id was set or not. If the variable is not set, then we will redirect the page url to the login page.

Add new comment

316 views