How to Create Login Page in PHP/MySQL using PDO Query

Submitted by argie on Saturday, November 23, 2013 - 17:46.

Yesterday I posted a tutorial on how to create a registration page using PHP/MySQL with PDO Query. To make some follow up with my registration page tutorial, I decided to create another tutorial on how to create a login page using PHP/MySQL with PDO Query Also. in this tutorial you will also learn how to use php server side validation and how to add filter in PDO Query. Username: admin Password: admin To start this tutorial let’s follow the steps bellow.

Creating Our Database

First we are going to create our database which stores our data. To create a database: 1. Open phpmyadmin 2. Then create database and name it as "pdo_ret". 3. After creating a database name, click the SQL and paste the following code.

CREATE TABLE IF NOT EXISTS `users` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `username` varchar(100) NOT NULL,
  `password` varchar(100) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=2 ;

Creating Our Form

Next step is to create a form and save it as index.php. This file include the login form and the script that display the error generated by the server.

<?php
session_start();
?>
<?php
if( isset($_SESSION['ERRMSG_ARR']) && is_array($_SESSION['ERRMSG_ARR']) && count($_SESSION['ERRMSG_ARR']) >0 ) {
	echo '<ul style="padding:0; color:red;">';
	foreach($_SESSION['ERRMSG_ARR'] as $msg) {
		echo '<li>',$msg,'</li>'; 
	}
	echo '</ul>';
	unset($_SESSION['ERRMSG_ARR']);
}
?>
<form action="reg.php" method="POST">
Username<br>
<input type="text" name="uname" /><br>
Password<br>
<input type="password" name="pword" /><br>
<input type="submit" value="Login" />
</form>

Writing Our Login Script

Next step is to create our login script that validates our input data and save it as "reg.php".

<?php
session_start();
$errmsg_arr = array();
$errflag = false;
// configuration
$dbhost 	= "localhost";
$dbname		= "pdo_ret";
$dbuser		= "root";
$dbpass		= "";
 
// database connection
$conn = new PDO("mysql:host=$dbhost;dbname=$dbname",$dbuser,$dbpass);
 
// new data
 
$user = $_POST['uname'];
$password = $_POST['pword'];
 
if($user == '') {
	$errmsg_arr[] = 'You must enter your Username';
	$errflag = true;
}
if($password == '') {
	$errmsg_arr[] = 'You must enter your Password';
	$errflag = true;
}
 
// query
$result = $conn->prepare("SELECT * FROM users WHERE username= :hjhjhjh AND password= :asas");
$result->bindParam(':hjhjhjh', $user);
$result->bindParam(':asas', $password);
$result->execute();
$rows = $result->fetch(PDO::FETCH_NUM);
if($rows > 0) {
header("location: home.php");
}
else{
	$errmsg_arr[] = 'Username and Password are not found';
	$errflag = true;
}
if($errflag) {
	$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
	session_write_close();
	header("location: index.php");
	exit();
}
 
?>

Creating Our Home page

Next step is to create a homepage and save it as "home.php". This is the landing page after you successfully login to our system.

<div style="text-align:center;margin-top:50px;font-family:arial;font-size:20px;">
	Congrats!<br>
	You've Benn Successfully Entered<br>
	In The<br>
	System<br>
</div>

That’s all you have already created your login page with server side validation and PDO query. Hope this code will help you, see you guys in my next tutorial.

Comments

I don't get why you have

$result->bindParam(':hjhjhjh', $user); $result->bindParam(':asas', $password); Why dud you have :hjhjhjh and :asas? Wouldn't it just be the value of whatever is entered by the user for their username and password??

to avoid SQL injection

to avoid SQL injection (Hacking)

It is much safer for

It is much safer for injection to prepare the select query and bind the variables You can also write it this way (its like you prefer) $result = $conn->prepare("SELECT * FROM users WHERE username= ? AND password= ?"); $result->bindParam(1, $user); $result->bindParam(2, $password); $result->execute(); Where 1 stands for the first question mark and 2 for the second question mark. Hope this helped!