Skip to main content
edited tags
Link
200_success
  • 144.2k
  • 22
  • 188
  • 473
Source Link
Jimmy
  • 473
  • 3
  • 10

A simple PHP login system

I'm super new to PHP and I'm trying to get a functional login system together. This is the code I have:

class/user.php

<?php
 class Users {
     public $username = null;
     public $password = null;
     public $salt = "Zo4rU5Z1YyKJAASY0PT6EUg7BBYdlEhPaNLuxAwU8lqu1ElzHv0Ri7EM6irpx5w";
     
     public function __construct( $data = array() ) {
         if( isset( $data['username'] ) ) $this->username = stripslashes( strip_tags( $data['username'] ) );
         if( isset( $data['password'] ) ) $this->password = stripslashes( strip_tags( $data['password'] ) );
     }
     
     public function storeFormValues( $params ) {
        //store the parameters
        $this->__construct( $params ); 
     }
     
     public function userLogin() {
         $success = false;
         try{
            $con = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD ); 
            $con->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
            $sql = "SELECT * FROM users WHERE username = :username AND password = :password LIMIT 1";
            
            $stmt = $con->prepare( $sql );
            $stmt->bindValue( "username", $this->username, PDO::PARAM_STR );
            $stmt->bindValue( "password", hash("sha256", $this->password . $this->salt), PDO::PARAM_STR );
            $stmt->execute();
            
            $valid = $stmt->fetchColumn();
            
            if( $valid ) {
                $success = true;
            }
            
            $con = null;
            return $success;
         }catch (PDOException $e) {
             echo $e->getMessage();
             return $success;
         }
     }
     
     public function register() {
        $correct = false;
            try {
                $con = new PDO( DB_DSN, DB_USERNAME, DB_PASSWORD );
                $con->setAttribute( PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION );
                $sql = "INSERT INTO users(username, password) VALUES(:username, :password)";
                
                $stmt = $con->prepare( $sql );
                $stmt->bindValue( "username", $this->username, PDO::PARAM_STR );
                $stmt->bindValue( "password", hash("sha256", $this->password . $this->salt), PDO::PARAM_STR );
                $stmt->execute();
                return "Registration Successful <br/> <a href='index.php'>Login Now</a>";
            }catch( PDOException $e ) {
                return $e->getMessage();
            }
     }
     
 }
 
?>

login.php

<?php 
    include_once("config.php");
?>
<?php if( !(isset( $_POST['login'] ) ) ) { ?>
    <form method="post" action="">
        <input type="text" maxlength="30" required autofocus name="username" />
        <input type="password" maxlength="30" required name="password" />
        <input type="submit" name="login" value="Log me in" />
    </form>
<?php 
} else {
    $usr = new Users;
    $usr->storeFormValues( $_POST );
    
    if( $usr->userLogin() ) {
        echo "Welcome"; 
    } else {
        echo "Incorrect Username/Password"; 
    }
}
?>

register.php

<?php 
    include_once("config.php");
?>

<?php if( !(isset( $_POST['register'] ) ) ) { ?>
    <form method="post">
        <input type="text" id="usn" maxlength="30" required autofocus name="username" />
        <input type="password" id="passwd" maxlength="30" required name="password" />
        <input type="password" id="conpasswd" maxlength="30" required name="conpassword" />
        <input type="submit" name="register" value="Register" />
    </form>

<?php 
} else {
    $usr = new Users;
    $usr->storeFormValues( $_POST );
    
    if( $_POST['password'] == $_POST['conpassword'] ) {
        echo $usr->register($_POST);    
    } else {
        echo "Password and Confirm password not match"; 
    }
}
?>

I am really keen to know how this code is structured, as I used information from several different tutorials combined to create it. Any input would be appreciated.