I found a class that i coded for an old project about a year ago and i haven't really touched php in a while. Now i need to use similar functionality again i thought it would be the perfect time to rewrite/improve old class. i would appreciate feedback on any errors you notice or advice on anything i should use such as design patterns etc.
include "db_config.php";
/**
*
*/
class User
{
//object variables
public $pdo;
public $user_data;
public function __construct()
{
$this->pdo = new PDO(
"mysql:host=" . DB_SERVER . ";dbname=" . DB_DATABASE, //DSN
DB_USERNAME, //Username
DB_PASSWORD //Password
);
$this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$this->pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
//add pdo error check
//check to see if the
if (isset($_SESSION['uid'])) {
$this->user_data = array('uid' => $_SESSION['uid'],
'email' => $_SESSION['email'],
'fname' => $_SESSION['fname'],
'lname' => $_SESSION['lname']);
}
}
/**
* Register Function
*/
public function user_register($email, $password, $fname, $lname)
{
$sql = "SELECT uemail FROM user_profile WHERE uemail = :email";
$stmt = $this->pdo->prepare($sql);
$stmt->bindValue(':email', $email);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);
$rowCount = $stmt->rowCount();
if ($rowCount > 0) {
//Email is already registered
return 0;
} else {//if email doesnt exist
//hash the password
$hashPassword = password_hash($password, PASSWORD_BCRYPT, array("cost" => 12 ));
//prepare insert statement
$sql = "INSERT INTO user_profile (uemail, upass, fname, lname) VALUES (:email, :password, :fname, :lname)";
$stmt = $this->pdo->prepare($sql);
//bind varaiables
$stmt->bindValue(':email', $email);
$stmt->bindValue(':password', $hashPassword);
$stmt->bindValue(':fname', $fname);
$stmt->bindValue(':lname', $lname);
//execute instert statment
$result = $stmt->execute();
if ($result) {
//register success
$this->user_login($email, $password);
return 1;
}
}
}
//login function
public function user_login($email, $password)
{
$sql = "SELECT * FROM user_profile WHERE uemail = :uemail";
$stmt = $this->pdo->prepare($sql);
$stmt->bindValue(':uemail', $email);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);
$rowCount = $stmt->rowCount();
if ($rowCount > 0) {
$test = password_verify($password, $row['upass']);
if (password_verify($password, $row['upass'])) {
$_SESSION['uid'] = $row['id'];
$_SESSION['email'] = $row['uemail'];
$_SESSION['fname'] = $row['fname'];
$_SESSION['lname'] = $row['lname'];
$_SESSION['logged_in'] = date("Y-m-d H:ia");
header("Location: index.php");
}
} else {
return false;
}
}
//get first name
public function get_fname($uid)
{
return $user_data['fname'];
}
public function get_lname($uid)
{
return $user_data['lname'];
}
// starting session
public function get_id()
{
return $_SESSION['uid'];
}
public function check_login()
{
if (isset($_SESSION['logged_in'])) {
return true;
} else {
return false;
}
}
//logout function to destroy session
public function user_logout()
{
$_SESSION['uid'] = FALSE;
$_SESSION['email'] = FALSE;
$_SESSION['fname'] = FALSE;
$_SESSION['lname'] = FALSE;
$_SESSION['logged_in'] = FALSE;
session_unset();
session_destroy();
header("Location: login.php");
}
}
also i think this was my first time using PDO so any feedback on the use or implementation of that would be appreciated Thanks in advance for the feedback