Jifunze kutengeneza Secure PHP Login System kwa kutumia PHP PDO na MySQL. Login yenye password hashing, sessions, CSRF protection, logout na protected pages.

Secure PHP Login System ni Nini?

Secure PHP Login System ni mfumo wa login unaolinda users na database dhidi ya makosa ya kawaida ya security.

Mfumo huu unatakiwa kuwa na:

password hashing
PDO prepared statements
session security
CSRF protection
input validation
protected pages
logout system

Kwa tutorials zaidi:
https://faulink.com

STEP 1 — Tengeneza Database
CREATE DATABASE secure_php_login;

USE secure_php_login;
STEP 2 — Tengeneza Users Table
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
full_name VARCHAR(150) NOT NULL,
username VARCHAR(100) NOT NULL UNIQUE,
email VARCHAR(150) UNIQUE,
password VARCHAR(255) NOT NULL,
status ENUM('active','inactive') DEFAULT 'active',
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);
STEP 3 — Database Connection

config.php

PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
]
);
} catch (PDOException $e) {
die("Database Connection Failed");
}

function clean($data) {
return htmlspecialchars(trim($data), ENT_QUOTES, 'UTF-8');
}

function isLoggedIn() {
return isset($_SESSION['user_id']);
}

function requireLogin() {
if (!isLoggedIn()) {
header("Location: index.php");
exit;
}
}

function logout() {
session_unset();
session_destroy();
header("Location: index.php");
exit;
}
?>
STEP 4 — CSRF Token
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

Weka token kwenye form:

Validate token:

function checkCsrf() {
if (
empty($_POST['csrf_token']) ||
empty($_SESSION['csrf_token']) ||
!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
) {
die("Invalid security token.");
}
}
STEP 5 — Register User

register.php

prepare("
SELECT id
FROM users
WHERE username = ? OR email = ?
LIMIT 1
");
$check->execute([$username, $email]);

if ($check->fetch()) {
$message = "Username or email already exists.";
} else {
$hashedPassword = password_hash($password, PASSWORD_DEFAULT);

$stmt = $pdo->prepare("
INSERT INTO users
(full_name, username, email, password)
VALUES (?, ?, ?, ?)
");

$stmt->execute([
$full_name,
$username,
$email,
$hashedPassword
]);

$message = "Account created successfully.";
}
}
}
?>

= clean($message); ?>

STEP 6 — Login User

index.php

prepare("
SELECT *
FROM users
WHERE username = ?
AND status = 'active'
LIMIT 1
");

$stmt->execute([$username]);
$user = $stmt->fetch();

if ($user && password_verify($password, $user['password'])) {
session_regenerate_id(true);

$_SESSION['user_id'] = $user['id'];
$_SESSION['full_name'] = $user['full_name'];
$_SESSION['username'] = $user['username'];

header("Location: dashboard.php");
exit;
} else {
$error = "Invalid username or password.";
}
}
?>

STEP 7 — Protected Dashboard

dashboard.php

Welcome, = clean($_SESSION['full_name']); ?>

You are logged in securely.

STEP 8 — Password Hashing
$hashedPassword = password_hash(
$password,
PASSWORD_DEFAULT
);

Verify password:

password_verify(
$password,
$user['password']
);
STEP 9 — Session Security

Baada ya login successful tumia:

session_regenerate_id(true);

Hii husaidia kuzuia session fixation.

STEP 10 — Protected Pages

Kila page inayohitaji login iwe na:

require_once 'config.php';

requireLogin();
STEP 11 — Logout System
function logout() {
session_unset();
session_destroy();

header("Location: index.php");
exit;
}
STEP 12 — Bootstrap Login Form

STEP 13 — Security Checklist
Tumia PDO prepared statements
Tumia password_hash()
Tumia password_verify()
Tumia session_regenerate_id(true)
Tumia CSRF token kwenye forms
Validate email
Safisha output kwa htmlspecialchars()
Zuia protected pages kwa requireLogin()
Usionyeshe database errors kwa users
Tumia HTTPS kwenye live website
Features za Secure PHP Login System
user registration
secure login
password hashing
session protection
CSRF protection
logout system
protected pages
Bootstrap login form
PDO prepared statements
input validation
Mfumo Huu Unaweza Kutumika Wapi?
Admin Dashboard
School Management System
Farm Management System
Accounting System
POS System
Inventory System
Hospital System
Hotel Booking System
Benefits za Secure PHP Login System
Better Security

Inalinda users na system dhidi ya attacks nyingi.

Professional Authentication

Unaweza kutumia kwenye project kubwa au ndogo.

Easy to Customize

Unaweza kuongeza roles, permissions na dashboard.

Reliable User Management

Users wanaingia na kutoka kwenye system kwa usalama.

Hitimisho

Secure PHP Login System ni msingi muhimu wa mfumo wowote wenye users.

Kwa kutumia PHP PDO, MySQL, password hashing, sessions na CSRF protection unaweza kutengeneza login system salama na professional.

Kwa tutorials zaidi tembelea:

https://faulink.com