User System (Part 1 - Using PDO)

This tutorial is based on the original PHP User System previously available on this site, but it has been upgraded to use PDO (PHP Data Objects) instead of the outdated MySQL extension.

Why PDO is Better Than MySQL:

Security: PDO supports prepared statements, which help prevent SQL injection attacks.
Flexibility: PDO works with multiple database systems (e.g., MySQL, PostgreSQL, SQLite) without requiring significant changes to your code.
Modern Features: PDO provides advanced features like transaction handling and better error reporting.
Future-Proof: The MySQL extension is deprecated and no longer supported in PHP, whereas PDO is actively maintained.

In this tutorial we will be creating a secure user registration and login system. It includes features like:

Registration with password encryption and email validation
Login functionality with session management
Email verification to activate accounts
Profile management with user levels and details

Features:

Encrypted passwords
Email Validation
Change Password
Members List
User Profiles

Lets start of with the SQL, one table to hold the members and one for verification codes (if enabled in the config.php file)

Run this query

SQL Query

CREATE TABLE `members` (
  `id` int(11) NOT NULL,
  `username` varchar(30) NOT NULL,
  `password` varchar(255) NOT NULL,
  `email` varchar(55) NOT NULL,
  `location` varchar(40) NOT NULL DEFAULT 'N/A',
  `userlevel` int(3) NOT NULL DEFAULT 1,
  `age` int(3) DEFAULT NULL,
  `gender` varchar(40) NOT NULL DEFAULT 'N/A'
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;
 
CREATE TABLE `verification` (
  `id` int(11) NOT NULL,
  `username` varchar(30) NOT NULL,
  `code` varchar(255) NOT NULL
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

Now we have the SQL lets start with the user system.

The config.php will be included at the start of each page for our user system, so this will be our database connection, logged in user details if logged in and some site settings

config.php

<?php
session_start(); // Start new or resume existing session
 
// PDO database connection
try {
    $conn = new PDO('mysql:host=localhost;dbname=DBNAME', 'USER', 'PASSWORD');    // Update DBNAME, USER and PASSWORD
    $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); // Set error mode to exception
} catch (PDOException $e) {
    die("Connection failed: " . $e->getMessage());
}
 
if (isset($_SESSION['id']) && isset($_SESSION['password'])) { // Check session for user are set
    // Query to fetch account details
    $statement = $conn->prepare("SELECT * FROM `members` WHERE `id` = :id AND `password` = :password");
    $statement->execute([
        ':id' => $_SESSION['id'],
        ':password' => $_SESSION['password']
    ]);
    $logged = $statement->fetch(PDO::FETCH_ASSOC);
}
 
// Some variables returned by the server (do not change these!)
$host = $_SERVER['HTTP_HOST'];
$self = $_SERVER['PHP_SELF'];
 
// Update the following to reflect your site settings
$sitename = "My Site"; // Your site name
$email_activation = true; // Email activation: true = enabled, false = disabled
 
?>

Change the connection and change your site name.

Now lets let people register

<?php
include "config.php";
 
if (isset($_GET['verify'])) { // Account verification process
    $code = $_GET['code']; // Directly use GET value (PDO already sanitizes input)
 
    $getcode = $conn->prepare("SELECT * FROM `verification` WHERE `code` = :code");
    $getcode->execute([':code' => $code]);
 
    if ($getcode->rowCount() == 0) {
        // Doesn't match any codes in the database
        echo "Invalid verification code!";
    } else {
        $userdata = $getcode->fetch(PDO::FETCH_ASSOC);
 
        // userlevel of 2 indicates account has now been email activated
        $update = $conn->prepare("UPDATE `members` SET `userlevel` = '2' WHERE `username` = :username");
        $update->execute([':username' => $userdata['username'}});
 
        // Remove the verification code from the database
        $delete = $conn->prepare("DELETE FROM `verification` WHERE `code` = :code");
        $delete->execute([':code' => $code]);
 
        echo "Thank you, Your account has been verified.";
    }
} else if (isset($_GET['register'])) { // User registration
    if (empty($_POST['username']) || empty($_POST['password']) || empty($_POST['cpassword']) || empty($_POST['email'])) {
        // If any fields are left blank
        echo "A field was left blank, please go back and try again.";
    } else if ($_POST['password'] != $_POST['cpassword']) {
        // If passwords do not match
        echo "Your password and confirmation password do not match!";
    } else {
        // Hash password using a strong one-way hashing algorithm
        $password = password_hash($_POST['password'], PASSWORD_DEFAULT); // Encrypt the password
 
        $cname = $conn->prepare("SELECT `username` FROM `members` WHERE `username` = :username");
        $cname->execute([':username' => $_POST['username'}});
 
        if ($cname->rowCount() >= 1) {
            // Account already exists with this username
            echo "The username is already in use";
        } else {
            $email = $_POST['email'];
            if ($email_activation) { // Email activation is enabled
                $insert = $conn->prepare("INSERT INTO `members` (`username`, `password`, `email`) VALUES (:username, :password, :email)");
                $insert->execute([':username' => $_POST['username'], ':password' => $password, ':email' => $email]);
 
                $code = substr(str_shuffle("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"), 0, 16); //Generate a random 16 charater code
 
                $insert_verification = $conn->prepare("INSERT INTO `verification` (`username`, `code`) VALUES (:username, :code)");
                $insert_verification->execute([':username' => $_POST['username'], ':code' => $code]);
 
                $link = "https://$host$self?verify&code=$code";
                // Send activation link to the user
                mail("$email", "Member-Ship Validation", "Thank you for registering on $sitename. Please copy the below link into your address bar: $link", "From: Site Verification");
 
                echo "You are now registered, please check your email to activate your account.";
            } else { // No email activation
                $insert = $conn->prepare("INSERT INTO `members` (`username`, `password`, `email`, `userlevel`) VALUES (:username, :password, :email, '2')");
                $insert->execute([':username' => $_POST['username'], ':password' => $password, ':email' => $email]);
 
                echo "You are now registered, you can now login to your account.";
            }
        }
    }
} else { // Show the registration form
    echo "<form action='register.php?register' method='post'>
        <table>
            <tr><td>Username:</td><td><input type='text' name='username' size='30'></td></tr>
            <tr><td>Password:</td><td><input type='password' name='password' size='30'></td></tr>
            <tr><td>Confirm Password:</td><td><input type='password' name='cpassword' size='30'></td></tr>
            <tr><td>Email:</td><td><input type='text' name='email' size='30'></td></tr>
            <tr><td colspan='2'><input type='submit' value='Register'></td></tr>
        </table>
    </form>";
}
?>

Now people can register lets let them login

<?php
include "config.php";
 
if (isset($logged['id'])) { 
    // If already logged in, show some user links 
    echo "Welcome " . htmlspecialchars($logged['username']) . "!";
    echo "- <a href='editprofile.php'>Edit Profile</a><br>
          - <a href='changepassword.php'>Change Password</a><br>
          - <a href='members.php'>Members</a><br>
          - <a href='logout.php?logout'>Logout</a>";
} elseif (isset($_GET['login'])) {
    $username = $_POST['username'] ?? '';
    $password = $_POST['password'] ?? '';
 
    // Query to check username and password
    $uinfo = $conn->prepare("SELECT * FROM `members` WHERE `username` = :username");
    $uinfo->execute([':username' => $username]);
    $udata = $uinfo->fetch(PDO::FETCH_ASSOC);
 
    if (!$udata || !password_verify($password, $udata['password'])) {
        // If user doesn't exist or if password is incorrect
        echo "Incorrect username or password!";
    } else if ($udata['userlevel'] == "1") {
        // userlevel of 1 indicates account has not been email activated
        echo "This account has not been verified.";
    } else {
        // Set the sessions
        $_SESSION['id'] = $udata['id'];
        $_SESSION['password'] = $udata['password'];
 
        // Let the user know and refresh
        echo "You are now logged in. Please wait...";
        echo "<meta http-equiv='Refresh' content='2; URL=login.php'/>";
    }
} else {
    // Not logged in so show form
    echo "<form action='login.php?login' method='post'>
        <table>
            <tr><td>Username:</td><td><input type='text' name='username'></td></tr>
            <tr><td>Password:</td><td><input type='password' name='password'></td></tr>
            <tr><td colspan='2'><input type='submit' value='Login'></td></tr>
        </table>
    </form>";
}
 
?>

The logout page is simply, just delete the sessions and redirect

logout.php

<?php
session_start(); // Start the session
session_unset(); // Remove all session variables
session_destroy(); // Destroy the session
header("Location: login.php"); // Redirect to homepage after logout
exit();
?>

Now lets display all the members

members.php

<?php
include "config.php";
 
if (isset($logged['id'])) { // Check if the user is logged in
 
    // Query to fetch all activated members
    $stmt = $conn->prepare("SELECT * FROM members WHERE userlevel = 2");
    $stmt->execute(); // Execute the query
    $members = $stmt->fetchAll(PDO::FETCH_ASSOC); // Fetch all results as an associative array
 
    if (count($members) > 0) { // At least 1 member in the database
        echo "<h2>Members List</h2><ul>";
        foreach ($members as $member) {
            echo "<li>Username: " . htmlspecialchars($member['username']) . 
                 " | Email: " . htmlspecialchars($member['email']) . 
                 " | Location: " . htmlspecialchars($member['location']) . 
                 " | Age: " . $member['age'] . 
                 " | Gender: " . htmlspecialchars($member['gender']) . "</li>";
        }
        echo "</ul>";
    } else {
        // Never going to be shown as the user is logged in, but this is a tutorial, so you can see how no results work...
        echo "No members found!";
    }
 
} else { // If the user is not logged in
    echo "You are not logged in.";
}
 
?>

Now we will make them able to edit there profile

editprofile.php

<?php
include "config.php";
 
if (isset($logged['id'])) { // Check if the user is logged in
 
    // Fetch current user details
    $stmt = $conn->prepare("SELECT * FROM members WHERE id = :id");
    $stmt->bindParam(':id', $logged['id'], PDO::PARAM_INT);
    $stmt->execute();
    $user = $stmt->fetch(PDO::FETCH_ASSOC);
 
    // Process form submission to update profile
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
 
        $stmt = $conn->prepare("UPDATE members SET email = :email, location = :location, age = :age, gender = :gender WHERE id = :id");
        $stmt->bindParam(':email', $_POST['email']);
        $stmt->bindParam(':location', $_POST['location']);
        $stmt->bindParam(':age', $_POST['age'], PDO::PARAM_INT);
        $stmt->bindParam(':gender', $_POST['gender']);
        $stmt->bindParam(':id', $logged['id'], PDO::PARAM_INT);
        $stmt->execute();
 
        echo "Profile updated successfully!";
    }
 
    // Display form
    echo '<form method="POST">
        <label>Email:</label>
        <input type="email" name="email" value="' . htmlspecialchars($user['email'] ?? '') . '" required>
        <label>Location:</label>
        <input type="text" name="location" value="' . htmlspecialchars($user['location'] ?? '') . '" required>
        <label>Age:</label>
        <input type="number" name="age" value="' . htmlspecialchars($user['age'] ?? '') . '" required>
        <label>Sex:</label>
        <select name="gender">
            <option value="male" ' . (($user['gender'] ?? '') === 'male' ? 'selected' : '') . '>Male</option>
            <option value="female" ' . (($user['gender'] ?? '') === 'female' ? 'selected' : '') . '>Female</option>
            <option value="other" ' . (($user['gender'] ?? '') === 'other' ? 'selected' : '') . '>Other</option>
        </select>
 
        <button type="submit">Update Profile</button>
    </form>';
 
} else {
    // Account is not logged in
    echo "You are not logged in.";
}
?>

Last thing in this tutorial is to let them change there password

changepassword.php

<?php
include "config.php";
 
if (isset($logged['id'])) { // Check if the user is logged in
    // Process form submission to change password
    if ($_SERVER['REQUEST_METHOD'] === 'POST') { // If form is submitted
 
        // Verify current password
        $stmt = $conn->prepare("SELECT password FROM members WHERE id = :id");
        $stmt->bindParam(':id', $logged['id'], PDO::PARAM_INT);
        $stmt->execute();
        $user = $stmt->fetch(PDO::FETCH_ASSOC);
 
        if (!password_verify($_POST['current_password'], $user['password'])) { // Check to see if current password is correct
             echo "Current password is incorrect!";
        } else if ($_POST['new_password'] !== $_POST['confirm_password']) { // Check if new password and confirm password match
            echo "New passwords do not match!";
        } else {
            // Hash password using a strong one-way hashing algorithm
            $hashedPassword = password_hash($_POST['new_password'], PASSWORD_DEFAULT);
 
            // Update password
            $stmt = $conn->prepare("UPDATE members SET password = :password WHERE id = :id");
            $stmt->bindParam(':password', $hashedPassword);
            $stmt->bindParam(':id', $logged['id'], PDO::PARAM_INT);
            $stmt->execute();
 
            echo "Password changed successfully!";
        }
 
    }
 
    echo '<form method="POST">
        <label>Current Password:</label>
        <input type="password" name="current_password" required>
        <label>New Password:</label>
        <input type="password" name="new_password" required>
        <label>Confirm New Password:</label>
        <input type="password" name="confirm_password" required>
        <button type="submit">Change Password</button>
    </form>';
 
 
} else {
    echo "You are not logged in.";
}
?>

Author:

DanielXP

Views:

359

Rating:

There are currently no comments for this tutorial, login or register to leave one.