Free Login Script (Tutorial)

[EatRamen]

Simple login script
Note: These are NOT the same script that Galapets uses, this is just a simple tutorial to show how a login using PHP works.

Required
- Webserver with PHP installed.
- Mysql database.
- Cookies enabled on your browser

Overview
We're setting this up using COOKIES. This is how it will work, the user logs in using his/her correct username/password combonation, we set a cookie on the users computer with:
a) Users username
b) Users password
Then we check to see if the user is logged on (for restricted content pages/etc).

STEP 1 Firstly, this is the HTML form we will be using. Save this in a file called 'login.php'.

<form action="login2.php" method="POST">
<table>
<td>Username: </td><td><input type="text" name="usern"></td>
<tr>
<td>Password:</td><td><input type="password" name="pw"></td>
</table>
</form>


Notice:

<input type="text" name="usern">

And...

<input type="password" name="pw">

You see how we gave our inputs names? Well, thats gonna help us later on to specify the difference between the two.


STEP 2 Next, make a file called 'login2.php' and follow along with the //comments. (The comments won't apear anywhere on the page, they just help us comment on the script.)

<?php //PHP start
ob_start(); //Allows us to use cookies, make sure this is on the top of every page that you use cookies in ANY way.
$usern = htmlspecialchars(strip_tags(mysql_escape_string($_ POST['usern']))); //Here we set the variable for the username, what all the functions do is make sure the user doesn't input 'harmful' strings into your database, etc.
$pw = htmlspecialchars(strip_tags(mysql_escape_string($_ POST['pw']))); //Same as above, except we set the variable for the password.

if ($usern == ""|$pw == "") {echo ("You left a field blank!"); die;} //Checks to see if the user forgot to fill in a field, if a field is blank, the page will 'die' here and discontinue from here on.

mysql_connect("HOST NAME HERE", "DATABASE USERNAME HERE", "DATABASE PASSWORD HERE"); //This connects us to your database, make sure you change the information to your database login info though
mysql_select_db(DATABASE NAME HERE); //This selects the database to user, again replace with your info

$usercheck = mysql_fetch_array(mysql_query("SELECT * FROM users WHERE username ='$usern'")); //Selects the user in your database with the same username that the user has just entered

if ($usercheck[password] != $pw) {echo ("Invalid login information"); die;} //Checks to see if the username's password matches the password that the user just entered

//If the page hasn't 'died' yet, that means that there were no errors, so we continue with login
setcookie("username", $usern, time()+3600); //Set the cookie called 'username' on the users browser that will last for 1 hour
setcookie("password", $pw, time()+3600); //Set the cookie called 'password' on the users browser that will last for 1 hour

echo ("You are now logged in!"); //Let user know he/she is logged in
?> //PHP end

So thats the PHP part of it, pretty simple, eh? Next lets set the database up.

STEP 3 Now log on to your database's PHPMyAdmin and follow these directions:
1. Click on your database name that is on the left hand side navigation bar.
2. Type in the name 'users' for the table name, and '3' for the number of rows and click go/save/whatever.
3. Type in 'id' for the first row's name, 'username' for the second rows name and 'password' for the third (Make sure that the type for all is varchar).
4. Type in '11' for the limit/amount for 'id' and 255' for both username and password.
5. Go back to 'id' and change 'varchar' to 'int' and extra to 'auto_increment' and click the radio next to the key icon.
Click on the button 'save'.

Next, (Almost done, bare with me) click on 'insert' on the top of the page, and insert the username/password you want on the first set of fields (Ignore the second set of fields underneath, and ignore the 'id' field)
Then click submit/done/whatever the button is called.

Its all done! Test it out using the username/password you added in your database!

(Note: I'll add the 'check login part in a few hours)

Its not tested, so if you find any errors, please tell. And also, if you have any problems understanding me, let me know D:

[Tigress]

What is the point of this? This script is targeted at people who don't know the first thing about PHP. How is a login script with next-to-nonexistent security going to help someone? I understand you're "just trying to help". But a login script is useless to someone who is bad enough at PHP to need this much instruction on how to use it - if they don't know what "die" does, they need to read a proper tutorial on PHP first.

The problem with these sorts of "tutorials" is that scripts such as these are not standalone scripts. The database connect and table setup are useless fluff - anyone who looks at a login tutorial should be competent enough to do that on their own, or at least to find another tutorial to help them do it. Either you should show someone how to do these things properly, or you should leave them out entirely.

I hope that made sense. In essence, my point is that this tutorial is attempting to act as a standalone "login script" tutorial for people who have no clue how to do anything with PHP. It is impossible to teach someone how to write a login script without giving them proper instruction in the actual basics first. So I suggest you target this at the skill level this should be targeted at, because no one will find it helpful otherwise.

[dc277]

I do my login scripts a little differently, but good tutorial. :D

[EatRamen]

What is the point of this? This script is targeted at people who don't know the first thing about PHP. How is a login script with next-to-nonexistent security going to help someone? I understand you're "just trying to help". But a login script is useless to someone who is bad enough at PHP to need this much instruction on how to use it - if they don't know what "die" does, they need to read a proper tutorial on PHP first.

The problem with these sorts of "tutorials" is that scripts such as these are not standalone scripts. The database connect and table setup are useless fluff - anyone who looks at a login tutorial should be competent enough to do that on their own, or at least to find another tutorial to help them do it. Either you should show someone how to do these things properly, or you should leave them out entirely.

I hope that made sense. In essence, my point is that this tutorial is attempting to act as a standalone "login script" tutorial for people who have no clue how to do anything with PHP. It is impossible to teach someone how to write a login script without giving them proper instruction in the actual basics first. So I suggest you target this at the skill level this should be targeted at, because no one will find it helpful otherwise.

Yeah, your right :P

But I'm sure that this will help at least someone, I know that these kind of tutorials helped me when I barely knew the functions/etc. but didn't really know how to put them toegether. If not, someone could just copy+paste the script if they want to use it.

I do my login scripts a little differently, but good tutorial.
Thanks, I do them differently too, but I tried to make it as simple as possible...

[FuRom]

I would like to state that:

ob_start();

does not allow you to specifically allow you to use cookies. It is used to buffer when your html content is generated. You can't send header information before content information, you'll get errors.

You need to put ob_end_flush(); at the bottom of your pages or the content will take longer than it should to generate. Also the use of the function mysql_escape_string(); is irrelevant if your server has magic quotes enabled. Also, the way he uses it isn't the most efficient. The most efficient way to use the function is:

foreach($_GET as $k => $v){
$_GET[$x] = mysql_escape_string($_GET[$v]);
}
foreach($_POST as $k => $v){
$_POST[$x] = mysql_escape_string($_POST[$v]);
}
foreach($_COOKIE as $k => $v){
$_COOKIE[$x] = mysql_escape_string($_COOKIE[$v]);
}

at the top of your script instead of hard coding it in. It'll eventually help you have smaller files and less worries while coding. You need to do a copy of the foreach statement for every server generated array that the use might be able to have control of.

Security in this script is minimal to none. It's not really that great of a script to learn from, because it has quite a few issues. Also, I wouldn't consider this a good tutorial, because a good tutorial shouldn't just tell a user how to install some script. It should give the user step by step understanding of how to make something. Anyways, with security aside, this is still not a great tutorial. It's good and all that someone tried to help out, but the lack of structure in the tutorial leaves the user with truly minimal understanding of the script.

[EatRamen]

Ah... I see, I didn't want to make it too complicated though... But I still see your point. xD

I did leave out some security.. Features... Or whatever you want to call them... Like I said, I didn't want to overwhelm the reader. Its just something to learn from, explaining the basics of a login and walking the reader (Someone who doesn't have a clue how to put a login together) through it.

[Tigress]

You're better off explaining how the $_COOKIE and $_SESSION superglobals can be used to keep a user logged in, things like that - basically, login on a more conceptual level. The concept itself is more important to understand than how to apply it, though both are undeniably important.

For example...

"Use mysql_real_escape_string(), it will make your queries more secure."

Or

"It is possible to 'inject' into queries by using quotes - people can use these quotes to 'end' your intended query and start a malicious query of their own. To stop that, you have to escape any quotes they put in their text. You can use the mysql_real_escape_string() function to do this."

Which, in the end, is more helpful to someone who wants to learn how to secure their scripts?

[EatRamen]

You right :) I should have went that route instead.

Honestly, I had nothing better to do so I decided to make a tutorial D: I thought it would help some people out, I guess...

[FaNtEcH]

Great tutorial..
Do you think this'll work for Website-Forum integration?

[EatRamen]

Uhm, I'm pretty sure you can if you name the cookies the same thing that the forum named them when they are set.... Also, i think it needs to be on the same url? I've never used pre-made forums before, so sorry for not being very much help D:

I'm not positive though.

[Jooshypnut]

Give the guy a break... its a good tutorial... Yeah it may not be the best for a high-end pet site, but for someone who just wants to throw a few scripts together and have a bit of fun, learn a bit here and there, then this script does the job...

Good job mate..

[EasyProgrammer]

It's helpful because it gets them used to seeing and reading the code.