Made this a while back. Its appears to be working fine. Excuse the front end appearance, only concerned with the back-end functionality at the moment. Any feed back/constructive criticism is welcome.
register.php
login.php
Thanks in advance.
VV.
register.php
PHP Code
<?php
<html>
<head>
<title>Registation page</title>
</head>
<body>
<form method="POST" method="">
<center>
<h1>Thank you for Registering at <?php
echo $_SERVER['SERVER_NAME'];
?></h1>
Username:<input type="text" name="username" autocomplete="off" /> <br />
Password:<input type="password" name="password" autocomplete="off" /> <br />
Re-Enter Password:<input type="password" name="password2" autocomplete="off" /> <br />
Email:<input type="text" name="email" autocomplete="off" /> <br />
<input type="submit" name="submit" value="Register" /></center>
</form>
</body>
</html>
<?php
require '/password.php';
require '/config.php';
if (isset($_POST['submit']))
{
// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['password2']) ||
empty($_POST['email']))
{
die("Error: All fields must be filled in!");
} else
{
$username = $_POST['username'];
$password = $_POST['password'];
$password2 = $_POST['password2'];
$email = $_POST['email'];
$userIp = ($_SERVER["REMOTE_ADDR"]);
$joinDate = date("Y-m-d H:i:s");
//secure the password
$hashedpass = password_hash($password, PASSWORD_DEFAULT);
$hashedpass2 = password_hash($password2, PASSWORD_DEFAULT);
//compare the plain text passwords
if ($password !== $password2)
{
die("Error: Passwords do not match!");
}
//check if email is valid
if (!filter_var($email, FILTER_VALIDATE_EMAIL))
{
die("Error: E-mail address is not valid!");
}
if (strlen($username) > 15)
{
die("Username character limit exceeded!");
}
if (strlen($username) < 6)
{
die("Username must contain more than 5 characters!");
}
if (strlen($password) < 6)
{
die("Password must contain more than 5 characters!");
}
if (strlen($email) > 30)
{
die("Email character limit exceeded!");
}
//check if the username is already registered. we use prepare() to get the data ready for assignment
$stmt = $conn->prepare("SELECT COUNT(`username`) FROM members WHERE `username` = :name");
//notice we use :name which is a placeholder for the username variable value, we execute the command.
$stmt->execute(array(':name' => $username));
//we use pdos fetch to see if its equal to 1 which means it exists in the db
if ($stmt->fetch(PDO::FETCH_COLUMN) >= 1)
{
die("Username: " . htmlentities($username) . " already exists in our database!");
}
//check if the email is already registered. Again we start with prepare.
$stmz = $conn->prepare("SELECT COUNT(`email`) FROM members WHERE `email` = :email");
//execute() again assigning the placeholder with the variable data
$stmz->execute(array(':email' => $email));
if ($stmz->fetch(PDO::FETCH_COLUMN) >= 1)
{
die("Email: " . htmlentities($email) . " already exists in our database!");
}
//get data ready for db insert, notice the insert into command in caps.
$sql = "INSERT INTO members (username, password, email, ip, joindate) VALUES (:username, :password, :email, :ip, :joindate)";
//prepare statement before inserting.
$q = $conn->prepare($sql);
//execute statement, with variable data into placeholders
$q->execute(array(
':username' => $username,
':password' => $hashedpass,
':email' => $email,
':ip' => $userIp,
':joindate' => $joinDate));
if ($q)
{
echo "<b>Thank you for registering " . htmlentities($username) .
"! <a href='login.php'>Click here to login</a></b>";
//send email to newly registered user
$to = $email;
$subject = "Your registration details.";
$message = "Thank you for registering.Your credentials are stated below:<br>Usernname: $username Password: $password";
$message = wordwrap($message, 70);
$from = "[email protected]";
$headers = "From: $from";
mail($to, $subject, $message, $headers);
}
}
}
?>login.php
PHP Code
<?php
<html>
<head>
<title>Login page</title>
</head>
<h1><center>Login @<?php
echo $_SERVER['SERVER_NAME'];
?></center></h1>
<body>
<form method="POST"><center>
Username:<input type="text" name="username" autocomplete="off" /><br />
Password:<input type="password" name="password" autocomplete="off" /><br />
<input type="submit" name="submit" value="Login" /></center>
</form>
</body>
</html>
<?php
session_start();
require '/password.php';
require '/config.php';
if (isset($_POST['submit']))
{
// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname", $dbuser, $dbpass);
$username = $_POST['username'];
$password = $_POST['password'];
if ($username == '')
{
die("You must enter a username!");
}
if ($password == '')
{
die("You must enter a password!");
}
//login query
$result = $conn->prepare("SELECT password FROM members WHERE username = :user");
$result->execute(array(':user' => $username));
$row = $result->fetch(PDO::FETCH_ASSOC);
//password_verify means that you need to select the hashed password from the database, and then compare that value to the plaintext password they entered in the $password variable, and introduce sessions.
if (password_verify($password, $row['password']))
{
$_SESSION['username'] = $username;
header("location:home.php");
} else
{
echo "Access denied!";
}
}
?>Thanks in advance.
VV.
