Dear reader,
Thanks for coming by on this thread to follow my tutorial!
We will have a little introduction first and and then we can start:)
Parts:
1) Introduction + Functions
2) Registration Handling
3) Login Handling
Enjoy :D
Spoiler (Click to View)In this tutorial we are going to learn how to create a blank login/register page with possible warnings.
We will use PDO for the database.
while we are using a MySQL DataBase, so we are still going to use PDO MySQL :D
note: not pdo with prepared statements [I was looking at the wrong script]
Spoiler (Click to View)
1) start by having a database setted up, in this tutorial we call the database loginscript
2) as we all know if you create a database you'd need to have a user which can access the database if you're using XAMPP [localhost webserver]
your credentials are [default settings]:
Host = localhost
Username = root
Password =
Database Name = loginscript
if you run on a webhosting it will be a different host-username-password-> database name can still be the same
3) make sure your account has the rights to: SELECT - UPDATE - DELETE - INSERT!
roots have this by default
4) if you run xampp you can skip this step.
make sure your ftp account has the right to upload/update/delete files [this is quite logical ofc.]
5) last but not least.
Make sure you're scripting in the correct file and do NOT copy paste. You won't learn anything from C+P!
This script is made in PHP 5.5.11
Make sure you're on atleast a PHP 5.0 or higher server [5.5 would be great but 5.0 servers should also work] you can use: "echo(phpinfo());" for the php info
Make sure ERROR DISPLAY is on in your php.ini [there shouldn't be any errors but there are always different settings on each server!]
Make sure crypt() -> BLOWFISH is enabled
Make sure MCrypt() functions is enabled [for the salt keys]
Make sure you have a brain!
Make sure you keep everything in the same directory or you'd need to change the "require's and the header() functions"
Spoiler (Click to View)
http://pastebin.com/87qq0kmt
all you need to know about this class is that it is basicly 2 functions which uses the prepared PDO funtions/statements
this will also handle our database error[s] such as can't connect to
no database found...
etc.etc. (see the die() function)
Spoiler (Click to View)
http://pastebin.com/Dae8LKV2
PHP always starts with <?php and always ends with ?>!
in this part you see how I set the mysql_pdo.class.php as requirement without it we cannot connect with any database.
you also see that we made some globals (so we can call it within the functions)
and these globals are set with the database info.
the globals are right under it set with the information needed to connect
Spoiler (Click to View)
http://pastebin.com/BZ9QbRwy
in this we are going to start with the functions class.
in this functions class we have 3 diffent regions
1) Main
2) Login Only
3) Register Only
the Main Region contains 2 sub regions
1) Username related
2) Password related
Regions are just to combine parts into that ("area") region
Functions
1) check_username(Argument[s] $username)
stdClass is a PHP included EMPTY class to make objects
on this way it's eassier to see what it is going about since min-max and username is in this case all going about the length of something
as you might see check_username will do the controle of it's length.
Must be > 4 characters and < 10 charaters.
if the username is in this requirement it will check for alphanumeric characters if the username is alpha numeric then it will return true
if it's not then it returns false, which is the same if the username is not in the length requirements
2) username_exists(Argument[s] $username)
in this we call the database to check if a user exists or not
if the user exists, it will return true
if the user doesn't exists, it will return false.
you might ask yourself why is it in the main region but you will see that later.
Note by @AntiPaste: using the COUNT function would be enough for this.
3) check_password(Argument[s] $password)
in this function we check for thee password length through regex and for it's characters because we do not want that the database might crash because some characters can't be read. that's why we only allow a-z A-Z 0-9 and ! @ # $ % ^ & * characters
max length may only be > min length and max length can be selected as you wish by yourself.
min length must ofc. be < max length
if the lengths and characters is valid then it will return true else it returns false
4) create_hashed_password(Argument[s] $password, $salt)
here is were the magic happens.
our salt is generated later on in the register region.
blowfish requires a salt to start with: $2y$12$ and ends with $ with between that a 22 characteric salt. the start and beginning is for the OPTIMAL hashing of the password using the blowfish function
(must ends with $ is discussable as not needed but it still may causes errors so keep the standards)
it will return the hashed password of: password + salt
Spoiler (Click to View)
http://pastebin.com/U3eZzNn4
here you see the login only region
these functions will only be used for the login and not for the register
1) receive_password(Argumen[s] $username)
receive_password does the same as the username exists but this will not return true or false this will return the account's password
2) receive_salt(Argument[s] $username)
receive_salt does the exact same thing as the receive_password but this will not return the password but the account's salt
3) equal_password(Argument[s] $username, $password)
this will hash the given password with the user's salt and if the hashed password from the database equals the hashes password it will return true else it returns false
note by @AntiPaste:
Use instead of in this case it doesn't really matter but it is handling the equalization stricter which is in this case better
Spoiler (Click to View)
http://pastebin.com/0SkeantZ
this part also the last part of this php file contains the register only region and the ending scope/end php file (} ?>)
1) create_salt()
this will return the 22 character long random salt key using mcrypt_create_iv() mcrypt_dev_urandom and bin2hex
2) register(Argument[s] $username, $password)
this function will return a true if the user is successfully registered.
if the user did not register successfully then it will return false
This is the end of part one of the whole tutorial.
Check out:
Part 2: Registration handling
Part 3: Login handling
Maybe coming soon [always check the last tutorial to keep this up2date!]:
Part 4: Remember me | Page Requires Login
Part 5: Delete an Account
Your sincerely,
hellomen/speed/Mike M.
Thanks for coming by on this thread to follow my tutorial!
We will have a little introduction first and and then we can start:)
Parts:
1) Introduction + Functions
2) Registration Handling
3) Login Handling
Enjoy :D
-=Introduction=-
Spoiler (Click to View)In this tutorial we are going to learn how to create a blank login/register page with possible warnings.
We will use PDO for the database.
while we are using a MySQL DataBase, so we are still going to use PDO MySQL :D
note: not pdo with prepared statements [I was looking at the wrong script]
-=Starting=-
Spoiler (Click to View)
1) start by having a database setted up, in this tutorial we call the database loginscript
2) as we all know if you create a database you'd need to have a user which can access the database if you're using XAMPP [localhost webserver]
your credentials are [default settings]:
Host = localhost
Username = root
Password =
Database Name = loginscript
if you run on a webhosting it will be a different host-username-password-> database name can still be the same
3) make sure your account has the rights to: SELECT - UPDATE - DELETE - INSERT!
roots have this by default
4) if you run xampp you can skip this step.
make sure your ftp account has the right to upload/update/delete files [this is quite logical ofc.]
5) last but not least.
Make sure you're scripting in the correct file and do NOT copy paste. You won't learn anything from C+P!
This script is made in PHP 5.5.11
Make sure you're on atleast a PHP 5.0 or higher server [5.5 would be great but 5.0 servers should also work] you can use: "echo(phpinfo());" for the php info
Make sure ERROR DISPLAY is on in your php.ini [there shouldn't be any errors but there are always different settings on each server!]
Make sure crypt() -> BLOWFISH is enabled
Make sure MCrypt() functions is enabled [for the salt keys]
Make sure you have a brain!
Make sure you keep everything in the same directory or you'd need to change the "require's and the header() functions"
mysql_pdo.class.php
Spoiler (Click to View)
http://pastebin.com/87qq0kmt
all you need to know about this class is that it is basicly 2 functions which uses the prepared PDO funtions/statements
this will also handle our database error[s] such as can't connect to
no database found...
etc.etc. (see the die() function)
-=functions.class.php=-
Spoiler (Click to View)
http://pastebin.com/Dae8LKV2
PHP always starts with <?php and always ends with ?>!
in this part you see how I set the mysql_pdo.class.php as requirement without it we cannot connect with any database.
you also see that we made some globals (so we can call it within the functions)
and these globals are set with the database info.
the globals are right under it set with the information needed to connect
Spoiler (Click to View)
http://pastebin.com/BZ9QbRwy
in this we are going to start with the functions class.
in this functions class we have 3 diffent regions
1) Main
2) Login Only
3) Register Only
the Main Region contains 2 sub regions
1) Username related
2) Password related
Regions are just to combine parts into that ("area") region
Functions
1) check_username(Argument[s] $username)
stdClass is a PHP included EMPTY class to make objects
on this way it's eassier to see what it is going about since min-max and username is in this case all going about the length of something
as you might see check_username will do the controle of it's length.
Must be > 4 characters and < 10 charaters.
if the username is in this requirement it will check for alphanumeric characters if the username is alpha numeric then it will return true
if it's not then it returns false, which is the same if the username is not in the length requirements
2) username_exists(Argument[s] $username)
in this we call the database to check if a user exists or not
if the user exists, it will return true
if the user doesn't exists, it will return false.
you might ask yourself why is it in the main region but you will see that later.
Note by @AntiPaste: using the COUNT function would be enough for this.
3) check_password(Argument[s] $password)
in this function we check for thee password length through regex and for it's characters because we do not want that the database might crash because some characters can't be read. that's why we only allow a-z A-Z 0-9 and ! @ # $ % ^ & * characters
max length may only be > min length and max length can be selected as you wish by yourself.
min length must ofc. be < max length
if the lengths and characters is valid then it will return true else it returns false
4) create_hashed_password(Argument[s] $password, $salt)
here is were the magic happens.
our salt is generated later on in the register region.
blowfish requires a salt to start with: $2y$12$ and ends with $ with between that a 22 characteric salt. the start and beginning is for the OPTIMAL hashing of the password using the blowfish function
(must ends with $ is discussable as not needed but it still may causes errors so keep the standards)
it will return the hashed password of: password + salt
Spoiler (Click to View)
http://pastebin.com/U3eZzNn4
here you see the login only region
these functions will only be used for the login and not for the register
1) receive_password(Argumen[s] $username)
receive_password does the same as the username exists but this will not return true or false this will return the account's password
2) receive_salt(Argument[s] $username)
receive_salt does the exact same thing as the receive_password but this will not return the password but the account's salt
3) equal_password(Argument[s] $username, $password)
this will hash the given password with the user's salt and if the hashed password from the database equals the hashes password it will return true else it returns false
note by @AntiPaste:
Use
PHP Code
<?php
===
PHP Code
<?php
==
Spoiler (Click to View)
http://pastebin.com/0SkeantZ
this part also the last part of this php file contains the register only region and the ending scope/end php file (} ?>)
1) create_salt()
this will return the 22 character long random salt key using mcrypt_create_iv() mcrypt_dev_urandom and bin2hex
2) register(Argument[s] $username, $password)
this function will return a true if the user is successfully registered.
if the user did not register successfully then it will return false
This is the end of part one of the whole tutorial.
Check out:
Part 2: Registration handling
Part 3: Login handling
Maybe coming soon [always check the last tutorial to keep this up2date!]:
Part 4: Remember me | Page Requires Login
Part 5: Delete an Account
Your sincerely,
hellomen/speed/Mike M.
![[Image: eVnoInG.png]](https://i.imgur.com/eVnoInG.png)
