How to Create a Secure PHP Login Script

If you have a website and want to keep some of the content on it secure against unauthorized users, you'll need a way to let authorized users log in to your system securely. A PHP script (in conjunction with a database management system, such as MySQL) using the PEAR library offers an effective interface between the user and your data.

Difficulty: Moderately Challenging

Instructions

Things You'll Need:

• User information database
• PHP running on the server

1. Use a PHP form to handle logins. At the start of the script, validate the form. Add a check to see whether the user is logged in already. If so, abort the current login process.

2. Connect to the database. The PHP script will have to include an administrative login and password that can access the database.

3. Create a pointer to the database instead of letting the script access the database directly.

4. Check and authenticate the user's login information by using the checkLogin method. Use a combination of user name, password, cookie and IP address for authentication. Store the password and cookie information as hashes.

5. Allow login through the PHP script. If you choose, this is a good time to update the user's cookie.

6. Set the session variables by using the setSession method.

7. Use the checkSession method to authenticate the user's information on every page.

Tips & Warnings

• Make sure to add error handling at appropriate points in your code (after each check), to deal with the possibility of bad logins.
• Use good database practices (unique user names, database roles and such) to ensure greater security.
• Don't use obvious words like "admin" for your login name or "password" for your password. These are not secure, ever.

Resources

• Try a PHP tutorial
• Get the code
• Find more PHP login security tips from Jeff Skrysak.