Authentication & Login System

Introduction

Almost every real web application needs some way to know who is using it. Authentication is the process of confirming that a visitor is who they claim to be, usually by checking a username or email against a password. Once that check succeeds, the application needs a way to "remember" the visitor as they move from page to page, which is where sessions come in.

In this lesson you will walk through the general shape of a login system: how a user registers, how the stored credentials get checked during login, and how a session keeps that user recognized across requests. You have already learned PDO and prepared statements, so the database side of these examples should feel familiar.

How a Login System Works

A typical login system is built from three cooperating pieces: a registration form that creates accounts, a login form that checks credentials, and a session mechanism that keeps the user "logged in" across multiple page loads. HTTP itself is stateless — every request is independent — so without a session, the server would forget who you are the instant you clicked a new link.

The Registration Flow

Registration is the step where an account is created. The form collects a username (or email) and a password, the server hashes that password, and both the username and the hash get saved as a new row in a users table.

<?php
// Assume $pdo is an existing PDO connection (see the PDO lesson)

$username = $_POST['username'];
$plainPassword = $_POST['password'];

// password_hash() is covered in detail in the next lesson.
// For now, just know it turns a plain password into a secure, one-way hash.
$hashedPassword = password_hash($plainPassword, PASSWORD_DEFAULT);

$stmt = $pdo->prepare('INSERT INTO users (username, password) VALUES (:username, :password)');
$stmt->execute([
    'username' => $username,
    'password' => $hashedPassword,
]);

echo 'Account created. You can now log in.';

The Login Flow

Login reverses the lookup: given a username and a submitted password, the script fetches the stored hash for that username and checks whether the submitted password matches it. It never re-hashes and compares hashes directly — instead it uses a dedicated verification function (password_verify(), covered next lesson) that understands how the hash was built.

Example: A Simplified Login Script

Here is a simplified version of a login script that ties the pieces together. It fetches the user by username, verifies the password, and — on success — starts a session and stores the logged-in user's id.

<?php
session_start();

// Assume $pdo is an existing PDO connection
$username = $_POST['username'];
$submittedPassword = $_POST['password'];

$stmt = $pdo->prepare('SELECT id, username, password FROM users WHERE username = :username');
$stmt->execute(['username' => $username]);
$user = $stmt->fetch();

if ($user && password_verify($submittedPassword, $user['password'])) {
    // Credentials are correct — start tracking this user in the session
    $_SESSION['user_id'] = $user['id'];

    header('Location: dashboard.php');
    exit;
} else {
    echo 'Invalid username or password.';
}

Location: dashboard.php
(The browser is redirected, and $_SESSION['user_id'] now holds the logged-in user's id for every later request.)

Protecting Pages with Sessions

Once a user is logged in, other pages need to check that a valid session exists before showing protected content. The pattern is simple: start the session, check whether the expected session value is set, and redirect away (usually back to the login page) if it is not.

<?php
session_start();

if (!isset($_SESSION['user_id'])) {
    // No logged-in user in this session — send them to log in first
    header('Location: login.php');
    exit;
}

// From here on, we know a logged-in user is viewing the page
echo 'Welcome back, user #' . $_SESSION['user_id'];

Because this check is just a few lines, it is common to place it at the top of every page that requires a login, or to pull it into its own file and require it at the top of each protected script.

<?php
session_start();

$_SESSION = [];
session_destroy();

header('Location: login.php');
exit;

A Note on Production Security

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

You now understand the overall anatomy of a login system: a registration form that stores a hashed password, a login script that verifies credentials and starts a session, and protected pages that check for that session before rendering.

The next lesson zooms into the hashing functions used here — password_hash() and password_verify() — and explains exactly how they keep stored passwords safe.