Admin

Software Developer

Add your Tutorial

21st June, 2026

PHP Login and Registration System – Complete Tutorial

Introduction
A login and registration system is one of the most essential components of any web application. Whether you're building a membership site, e-commerce platform, or dashboard, user authentication is critical. This tutorial will teach you how to build a secure PHP login and registration system using modern security practices like password hashing, prepared statements, and session management.

By the end of this tutorial, you'll have a fully functional authentication system that you can integrate into any PHP project.

Project File Structure

project-folder/
├── config/
│   └── database.php          # Database connection
├── auth/
│   ├── register.php          # Registration page
│   ├── login.php             # Login page
│   ├── logout.php            # Logout handler
│   └── dashboard.php         # Protected page
├── assets/
│   └── css/
│       └── style.css         # Styling
└── index.php                 # Home page

Step 1: Database Setup

First, create your MySQL database and users table:

CREATE DATABASE auth_system;
USE auth_system;

CREATE TABLE users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    email VARCHAR(100) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    full_name VARCHAR(100),
    verification_code VARCHAR(64) DEFAULT NULL,
    is_verified TINYINT(1) DEFAULT 0,
    reset_token VARCHAR(64) DEFAULT NULL,
    reset_token_expiry DATETIME DEFAULT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    INDEX idx_email (email),
    INDEX idx_username (username)
);

Step 2: Database Connection (config/database.php)

<?php
// config/database.php
class Database {
    private $host = "localhost";
    private $db_name = "auth_system";
    private $username = "root";
    private $password = "";
    private $conn;

    public function getConnection() {
        $this->conn = null;
        try {
            $this->conn = new PDO(
                "mysql:host=" . $this->host . ";dbname=" . $this->db_name . ";charset=utf8mb4",
                $this->username,
                $this->password,
                [
                    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
                    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
                    PDO::ATTR_EMULATE_PREPARES => false,
                ]
            );
        } catch (PDOException $exception) {
            // Log error (don't expose details in production)
            error_log("Database Connection Error: " . $exception->getMessage());
            die("Database connection failed. Please try again later.");
        }
        return $this->conn;
    }
}
?>

Step 3: User Class with Helper Functions (classes/User.php)

<?php
// classes/User.php
class User {
    private $conn;
    private $table = "users";

    public function __construct($db) {
        $this->conn = $db;
    }

    // Register new user
    public function register($username, $email, $password, $full_name = "") {
        // Check if email exists
        if ($this->emailExists($email)) {
            return ["success" => false, "message" => "Email already registered."];
        }

        // Check if username exists
        if ($this->usernameExists($username)) {
            return ["success" => false, "message" => "Username already taken."];
        }

        // Hash password
        $hashed_password = password_hash($password, PASSWORD_BCRYPT, ['cost' => 12]);
        
        // Generate verification code (optional for email verification)
        $verification_code = bin2hex(random_bytes(32));

        // Insert user
        $query = "INSERT INTO " . $this->table . " 
                 (username, email, password, full_name, verification_code) 
                 VALUES (:username, :email, :password, :full_name, :verification_code)";
        
        $stmt = $this->conn->prepare($query);
        
        // Sanitize inputs
        $username = htmlspecialchars(strip_tags($username));
        $email = htmlspecialchars(strip_tags($email));
        $full_name = htmlspecialchars(strip_tags($full_name));

        $stmt->bindParam(":username", $username);
        $stmt->bindParam(":email", $email);
        $stmt->bindParam(":password", $hashed_password);
        $stmt->bindParam(":full_name", $full_name);
        $stmt->bindParam(":verification_code", $verification_code);

        if ($stmt->execute()) {
            return [
                "success" => true, 
                "message" => "Registration successful! Please check your email to verify your account.",
                "user_id" => $this->conn->lastInsertId()
            ];
        }
        return ["success" => false, "message" => "Registration failed. Please try again."];
    }

    // Login user
    public function login($email, $password) {
        $query = "SELECT id, username, email, password, full_name, is_verified 
                  FROM " . $this->table . " 
                  WHERE email = :email LIMIT 1";
        
        $stmt = $this->conn->prepare($query);
        $email = htmlspecialchars(strip_tags($email));
        $stmt->bindParam(":email", $email);
        $stmt->execute();

        if ($stmt->rowCount() > 0) {
            $row = $stmt->fetch();
            
            // Verify password
            if (password_verify($password, $row['password'])) {
                // Check if email is verified
                if (!$row['is_verified']) {
                    return ["success" => false, "message" => "Please verify your email address first."];
                }
                
                // Remove password from return data
                unset($row['password']);
                return ["success" => true, "message" => "Login successful!", "user" => $row];
            }
        }
        return ["success" => false, "message" => "Invalid email or password."];
    }

    // Check if email exists
    public function emailExists($email) {
        $query = "SELECT id FROM " . $this->table . " WHERE email = :email LIMIT 1";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":email", $email);
        $stmt->execute();
        return $stmt->rowCount() > 0;
    }

    // Check if username exists
    public function usernameExists($username) {
        $query = "SELECT id FROM " . $this->table . " WHERE username = :username LIMIT 1";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":username", $username);
        $stmt->execute();
        return $stmt->rowCount() > 0;
    }

    // Get user by ID
    public function getUserById($id) {
        $query = "SELECT id, username, email, full_name, created_at 
                  FROM " . $this->table . " WHERE id = :id LIMIT 1";
        $stmt = $this->conn->prepare($query);
        $stmt->bindParam(":id", $id, PDO::PARAM_INT);
        $stmt->execute();
        return $stmt->fetch();
    }
}
?>

Step 4: Registration Page (auth/register.php)

<?php
// auth/register.php
session_start();
require_once '../config/database.php';
require_once '../classes/User.php';

// Redirect if already logged in
if (isset($_SESSION['user_id'])) {
    header("Location: dashboard.php");
    exit;
}

$database = new Database();
$db = $database->getConnection();
$user = new User($db);

$message = '';
$message_type = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // CSRF Protection
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        $message = "Invalid CSRF token.";
        $message_type = "danger";
    } else {
        $username = trim($_POST['username']);
        $email = trim($_POST['email']);
        $password = $_POST['password'];
        $confirm_password = $_POST['confirm_password'];
        $full_name = trim($_POST['full_name']);
        
        // Validation
        $errors = [];
        
        if (strlen($username) < 3 || strlen($username) > 50) {
            $errors[] = "Username must be between 3 and 50 characters.";
        }
        if (!preg_match('/^[a-zA-Z0-9_]+$/', $username)) {
            $errors[] = "Username can only contain letters, numbers, and underscores.";
        }
        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $errors[] = "Please enter a valid email address.";
        }
        if (strlen($password) < 8) {
            $errors[] = "Password must be at least 8 characters.";
        }
        if (!preg_match('/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/', $password)) {
            $errors[] = "Password must contain at least one uppercase letter, one lowercase letter, one number, and one special character.";
        }
        if ($password !== $confirm_password) {
            $errors[] = "Passwords do not match.";
        }
        
        if (empty($errors)) {
            $result = $user->register($username, $email, $password, $full_name);
            if ($result['success']) {
                $message = $result['message'];
                $message_type = "success";
                // Clear form on success
                $_POST = [];
            } else {
                $message = $result['message'];
                $message_type = "danger";
            }
        } else {
            $message = implode("<br>", $errors);
            $message_type = "danger";
        }
    }
}

// Generate CSRF token
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Register - Create Your Account</title>
    <meta name="description" content="Create your account. Secure PHP registration system with password strength validation.">
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        body { background-color: #f8f9fa; }
        .register-container { max-width: 500px; margin: 50px auto; }
        .password-requirements { font-size: 0.85rem; color: #6c757d; }
    </style>
</head>
<body>
    <div class="container">
        <div class="register-container">
            <div class="card shadow">
                <div class="card-body p-4">
                    <h2 class="text-center mb-4">Create Your Account</h2>
                    
                    <?php if ($message): ?>
                        <div class="alert alert-<?= $message_type ?> alert-dismissible fade show">
                            <?= $message ?>
                            <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
                        </div>
                    <?php endif; ?>

                    <form method="POST" action="" id="registerForm" novalidate>
                        <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                        
                        <div class="mb-3">
                            <label for="full_name" class="form-label">Full Name</label>
                            <input type="text" class="form-control" id="full_name" name="full_name" 
                                   value="<?= htmlspecialchars($_POST['full_name'] ?? '') ?>" 
                                   placeholder="John Doe">
                        </div>

                        <div class="mb-3">
                            <label for="username" class="form-label">Username <span class="text-danger">*</span></label>
                            <input type="text" class="form-control" id="username" name="username" required
                                   value="<?= htmlspecialchars($_POST['username'] ?? '') ?>" 
                                   placeholder="johndoe" minlength="3" maxlength="50">
                        </div>

                        <div class="mb-3">
                            <label for="email" class="form-label">Email Address <span class="text-danger">*</span></label>
                            <input type="email" class="form-control" id="email" name="email" required
                                   value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" 
                                   placeholder="[email protected]">
                        </div>

                        <div class="mb-3">
                            <label for="password" class="form-label">Password <span class="text-danger">*</span></label>
                            <input type="password" class="form-control" id="password" name="password" required minlength="8">
                            <div class="password-requirements mt-1">
                                <small>Must contain: 8+ characters, uppercase, lowercase, number, and special character</small>
                            </div>
                        </div>

                        <div class="mb-3">
                            <label for="confirm_password" class="form-label">Confirm Password <span class="text-danger">*</span></label>
                            <input type="password" class="form-control" id="confirm_password" name="confirm_password" required>
                            <div class="invalid-feedback">Passwords do not match.</div>
                        </div>

                        <div class="mb-3 form-check">
                            <input type="checkbox" class="form-check-input" id="terms" required>
                            <label class="form-check-label" for="terms">
                                I agree to the <a href="/terms-of-service">Terms of Service</a> and <a href="/privacy-policy">Privacy Policy</a>
                            </label>
                        </div>

                        <button type="submit" class="btn btn-primary w-100">Create Account</button>
                    </form>

                    <div class="text-center mt-3">
                        <p>Already have an account? <a href="login.php">Sign In</a></p>
                    </div>
                </div>
            </div>
        </div>
    </div>

    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
    <script>
    // Client-side password match validation
    document.getElementById('confirm_password').addEventListener('input', function() {
        if (this.value !== document.getElementById('password').value) {
            this.setCustomValidity('Passwords do not match.');
        } else {
            this.setCustomValidity('');
        }
    });
    </script>
</body>
</html>

Step 5: Login Page (auth/login.php)

<?php
// auth/login.php
session_start();
require_once '../config/database.php';
require_once '../classes/User.php';

// Redirect if already logged in
if (isset($_SESSION['user_id'])) {
    header("Location: dashboard.php");
    exit;
}

$database = new Database();
$db = $database->getConnection();
$user = new User($db);

$message = '';
$message_type = '';
$login_attempts_key = 'login_attempts_' . $_SERVER['REMOTE_ADDR'];

// Rate limiting - check attempts
if (!isset($_SESSION[$login_attempts_key])) {
    $_SESSION[$login_attempts_key] = ['count' => 0, 'last_attempt' => time()];
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Check rate limiting (max 5 attempts per 15 minutes)
    $attempts = $_SESSION[$login_attempts_key];
    if ($attempts['count'] >= 5 && (time() - $attempts['last_attempt']) < 900) {
        $wait_time = 900 - (time() - $attempts['last_attempt']);
        $message = "Too many login attempts. Please try again in " . ceil($wait_time/60) . " minutes.";
        $message_type = "danger";
    } else {
        // CSRF Protection
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            $message = "Invalid CSRF token.";
            $message_type = "danger";
        } else {
            $email = trim($_POST['email']);
            $password = $_POST['password'];
            $remember = isset($_POST['remember']);
            
            if (empty($email) || empty($password)) {
                $message = "Please fill in all fields.";
                $message_type = "danger";
            } else {
                $result = $user->login($email, $password);
                
                if ($result['success']) {
                    // Reset login attempts
                    unset($_SESSION[$login_attempts_key]);
                    
                    // Set session variables
                    $_SESSION['user_id'] = $result['user']['id'];
                    $_SESSION['username'] = $result['user']['username'];
                    $_SESSION['email'] = $result['user']['email'];
                    
                    // Regenerate session ID for security
                    session_regenerate_id(true);
                    
                    // Remember me functionality (30 days)
                    if ($remember) {
                        $token = bin2hex(random_bytes(32));
                        setcookie('remember_token', $token, time() + (86400 * 30), "/", "", true, true);
                        // Store token in database (implement as needed)
                    }
                    
                    header("Location: dashboard.php");
                    exit;
                } else {
                    $message = $result['message'];
                    $message_type = "danger";
                    
                    // Increment login attempts
                    $_SESSION[$login_attempts_key]['count']++;
                    $_SESSION[$login_attempts_key]['last_attempt'] = time();
                }
            }
        }
    }
}

// Generate CSRF token
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Login - Secure Authentication</title>
    <meta name="description" content="Sign in to your account. Secure PHP login system with rate limiting and CSRF protection.">
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        body { background-color: #f8f9fa; }
        .login-container { max-width: 450px; margin: 80px auto; }
    </style>
</head>
<body>
    <div class="container">
        <div class="login-container">
            <div class="card shadow">
                <div class="card-body p-4">
                    <h2 class="text-center mb-4">Sign In</h2>
                    
                    <?php if ($message): ?>
                        <div class="alert alert-<?= $message_type ?> alert-dismissible fade show">
                            <?= $message ?>
                            <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
                        </div>
                    <?php endif; ?>

                    <form method="POST" action="">
                        <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                        
                        <div class="mb-3">
                            <label for="email" class="form-label">Email Address</label>
                            <input type="email" class="form-control" id="email" name="email" required
                                   placeholder="[email protected]" autocomplete="email">
                        </div>

                        <div class="mb-3">
                            <label for="password" class="form-label">Password</label>
                            <input type="password" class="form-control" id="password" name="password" required
                                   placeholder="Enter your password" autocomplete="current-password">
                        </div>

                        <div class="mb-3 form-check">
                            <input type="checkbox" class="form-check-input" id="remember" name="remember">
                            <label class="form-check-label" for="remember">Remember me</label>
                        </div>

                        <button type="submit" class="btn btn-primary w-100">Sign In</button>
                    </form>

                    <div class="text-center mt-3">
                        <a href="/forgot-password">Forgot Password?</a>
                    </div>
                    <div class="text-center mt-2">
                        <p>Don't have an account? <a href="register.php">Create Account</a></p>
                    </div>
                </div>
            </div>
        </div>
    </div>

    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>

Step 6: Protected Dashboard Page (auth/dashboard.php)

<?php
// auth/dashboard.php
session_start();
require_once '../config/database.php';
require_once '../classes/User.php';

// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
    header("Location: login.php?error=Please login first");
    exit;
}

$database = new Database();
$db = $database->getConnection();
$user = new User($db);
$user_data = $user->getUserById($_SESSION['user_id']);
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Dashboard - User Panel</title>
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body>
    <nav class="navbar navbar-expand-lg navbar-dark bg-dark">
        <div class="container">
            <a class="navbar-brand" href="#">MyApp</a>
            <div class="navbar-nav ms-auto">
                <span class="nav-link text-light">
                    Welcome, <?= htmlspecialchars($user_data['full_name'] ?? $user_data['username']) ?>
                </span>
                <a href="logout.php" class="btn btn-outline-light btn-sm ms-2">Logout</a>
            </div>
        </div>
    </nav>

    <div class="container mt-5">
        <div class="row">
            <div class="col-md-8 mx-auto">
                <div class="card shadow">
                    <div class="card-body">
                        <h3>Dashboard</h3>
                        <p>You are successfully logged in!</p>
                        
                        <table class="table table-bordered mt-3">
                            <tr>
                                <th>User ID</th>
                                <td><?= htmlspecialchars($user_data['id']) ?></td>
                            </tr>
                            <tr>
                                <th>Username</th>
                                <td><?= htmlspecialchars($user_data['username']) ?></td>
                            </tr>
                            <tr>
                                <th>Email</th>
                                <td><?= htmlspecialchars($user_data['email']) ?></td>
                            </tr>
                            <tr>
                                <th>Full Name</th>
                                <td><?= htmlspecialchars($user_data['full_name']) ?></td>
                            </tr>
                            <tr>
                                <th>Member Since</th>
                                <td><?= $user_data['created_at'] ?></td>
                            </tr>
                        </table>
                    </div>
                </div>
            </div>
        </div>
    </div>

    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>

Step 7: Logout (auth/logout.php)

<?php
// auth/logout.php
session_start();

// Clear all session variables
$_SESSION = [];

// Destroy the session cookie
if (ini_get("session.use_cookies")) {
    $params = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000,
        $params["path"], $params["domain"],
        $params["secure"], $params["httponly"]
    );
}

// Destroy the session
session_destroy();

// Clear remember me cookie if exists
if (isset($_COOKIE['remember_token'])) {
    setcookie('remember_token', '', time() - 3600, "/", "", true, true);
}

// Redirect to login page
header("Location: login.php?msg=logged_out");
exit;
?>

Security Best Practices

// Recommended PHP.ini settings for security
session.cookie_httponly = 1
session.cookie_secure = 1    // Enable if using HTTPS
session.cookie_samesite = "Strict"
session.use_strict_mode = 1
session.use_only_cookies = 1

Conclusion

You've successfully built a secure PHP login and registration system with:

Password hashing using bcrypt
CSRF protection
Session management
Rate limiting
Input validation
Remember me functionality

This system can be extended with:

Email verification
Password reset functionality
Two-factor authentication (2FA)
Social login (OAuth)
User roles and permissions

Popular Tools for Developers

Free Sample Files (Image,Video,Audio,Documents) For Testing CSS Minifier Js Minifier JSON Viewer and Formatter

Popular Tools for Project Manager

SSL Checker

Popular Tools for Youtubers

BIC Code(Swift Code) for Adsense Generate YouTube Subscribe Button

Other Tools for Daily Life

Google drive sharelink to download link.

Admin

Related Tutorial

PHP Session Management – Complete Guide.

PHP MySQLi vs PDO – Which Database Extension to Use?.

PHP REST API Tutorial: Build RESTful APIs from Scratch.

PHP Send Email with SMTP PHPMailer Complete Tutorial.

PHP File Upload Tutorial: Secure Upload System with Validation.

PHP CRUD Operations with MySQL: Complete Step-by-Step Guide.

Mastering DataTables: Implementing Column Filtering and Server-Side Processing with PHP.

Download XAMPP with Multiple PHP Versions: Easy Installation Guide.

A Guide to Types of Arrays in PHP.

How to Use Session Variables in PHP.

Popular Tools for Developers

Popular Tools for Project Manager

Popular Tools for Youtubers

Other Tools for Daily Life

About us

Find Online Tools

Quick links

Social links

Other