How to Create a Secure PHP Login Script

Video Transcript

"Hi, my name is Dave Andrews, today I'm going to show you how to create a secure login script at PHP. I have three files on my desktop, a login, do login, and logged in. Let's open up the login webpage by opening it with note pad. It's just a simple HTML page that has a form that points to do log in dot PHP. What's important is that I'm using the method of post. When you use the post method in your forms, it keeps your variables that are being sent to your program from being shown in the address bar on your browser. All that's hidden and that's part of security for the secure login. I have a user name and a password and I've given them somewhat undescriptive names as to the names of the variable. For user name I've just used U for password just P, and then I have my submit form. On the do login dot PHP, let's open it with note pad, and the very first thing I do is set the U and P variables to be blank. This way nobody can put possibly put in their own valuables for those two variables. I then check to see if U and P have been set in PHP. If they have, I assign the U and P values to their values. It's important that you do this also to keep people from injecting their own values in. I might do a comparison very simple seeing if U is my user and P is my pass, and if it is, I'm going to shoot them to logged in dot htm, and if not I'm going to send them back to the login page. Logged in is a very simple page, but if we open it with note pad, it just says you are now logged in. Let's do a demonstration. Open up your internet browser. And I've already uploaded these files to my server, so let's just go to my login and then login dot htm. As you can see here's our please login form as I've just described it to you. I'm going to give it good values for the login of my user and for password my pass. And say login. As you can see I have been logged in. Let's go back and give it some incorrect values. My user and the password one, two, three, four. Try to log in. It shot me back to the login page. One thing to note is that on your logged in form, let's open that with note pad, I'm not doing any verification as far as session values that they have been logged in. It's always a good idea in your login script to use session variables, that way for the later pages you can shoot them back out if they haven't been logged in."