Password Security - Basic PHP Login System Part 3

This short tutorial series shows you how to create a very basic login functionality, that you can add to your websites. In the third part of this series of tutorials, I cover password security best practices in PHP, using Bcrypt. We continue with the code from the previous lesson and implement a more secure way of storing passwords.

Video
#

Code
#

bcrypt-test.php
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
<?php
$options = array('cost' => 12);
echo "Bcrypt: ";
echo $hash = password_hash("password", PASSWORD_BCRYPT, $options);
echo "<br>";
echo "Verify now:<br>";
if (password_verify('password', $hash)) {
    echo 'Password is valid!';
} else {
    echo 'Invalid password.';
}
?>

dbConnect.php
1
2
3
<?php
$dbCon = mysqli_connect("localhost", "root", "", "tutorials");
?>

index.php
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
<?php
session_start();

if (isset($_POST['username'])) {
	
	include_once("dbConnect.php");
	
	// Set the posted data from the form into local variables
	$usname = strip_tags($_POST['username']);
	$paswd = strip_tags($_POST['password']);
	
	$usname = mysqli_real_escape_string($dbCon, $usname);
	$paswd = mysqli_real_escape_string($dbCon, $paswd);
	
	$sql = "SELECT id, username, password FROM members WHERE username = '$usname' AND activated = '1' LIMIT 1";
	$query = mysqli_query($dbCon, $sql);
	$row = mysqli_fetch_row($query);
	$uid = $row[0];
	$dbUsname = $row[1];
	$dbPassword = $row[2];
	
	// Check if the username and the password they entered was correct
	if ($usname == $dbUsname && password_verify($paswd,$dbPassword)) {
		// Set session 
		$_SESSION['username'] = $usname;
		$_SESSION['id'] = $uid;
		// Now direct to users feed
		header("Location: user.php");
	} else {
		echo "<h2>Oops that username or password combination was incorrect.
		<br /> Please try again.</h2>";
	}
	
}
?>

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Basic login system</title>
<style type="text/css">
html {
	font-family: Verdana, Geneva, sans-serif;
}
h1 {
	font-size: 24px;
	text-align: center;
}
#wrapper {
	position: absolute;
	width: 100%;
	top: 30%;
	margin-top: -50px;/* half of #content height*/
}
#form {
	margin: auto;
	width: 200px;
	height: 100px;
}
</style>
</head>

<body>
<div id="wrapper">
<h1>Simple PHP Login</h1>
<form id="form" action="index.php" method="post" enctype="multipart/form-data">
Username: <input type="text" name="username" /> <br />
Password: <input type="password" name="password" /> <br />
<input type="submit" value="Login" name="Submit" />
</form>
</body>
</html>

logout.php
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
<?php
session_start();
session_destroy(); 
if (isset($_SESSION['username'])) { 
	$msg = "You are now logged out";
} else {
	$msg = "<h2>Could not log you out</h2>";
} 
?> 
<html>
<body>
<?php echo $msg; ?><br>
<p><a href="/login-test">Click here</a> to return to our home page </p>
</body>
</html>

user.php
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
<?php
session_start();

if (isset($_SESSION['id'])) {
	// Put stored session variables into local PHP variable
	$uid = $_SESSION['id'];
	$usname = $_SESSION['username'];
	$result = "Test variables: <br /> Username: ".$usname. "<br /> Id: ".$uid;
} else {
	$result = "You are not logged in yet";
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title><?php echo $usname ;?> - Test Site</title>
</head>

<body>
<?php
echo $result;
?>
</body>
</html>

View on GitHub

Download the code

Video#

Code#

Video
#

Code
#