JINSI YA KUTENGENEZA SECURE LOGIN SYSTEM KWA PHP NA MYSQL (COMPLETE EXAMPLE)

Secure login system inapaswa kuwa na:

Password hashing – password_hash() na password_verify()

Prepared statements – kuzuia SQL injection

Session management – kudumisha authentication

Input validation & sanitization – kuzuia malicious input

⚙️ 2. Database Structure (MySQL)
CREATE DATABASE secure_login;

USE secure_login;

CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL UNIQUE,
email VARCHAR(100) NOT NULL UNIQUE,
password VARCHAR(255) NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

🧩 3. Registration Page (register.php)

setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
} catch(PDOException $e){
die("DB Connection failed: " . $e->getMessage());
}

if(isset($_POST['register'])){
$username = htmlspecialchars(trim($_POST['username']));
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$password = $_POST['password'];

if(!filter_var($email, FILTER_VALIDATE_EMAIL)){
die("❌ Invalid email address.");
}

$hashed_password = password_hash($password, PASSWORD_DEFAULT);

$stmt = $pdo->prepare("INSERT INTO users (username, email, password) VALUES (:username, :email, :password)");
$stmt->execute([
'username' => $username,
'email' => $email,
'password' => $hashed_password
]);

echo "✅ Registration successful!";
}
?>

🧩 4. Login Page (login.php)

setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

if(isset($_POST['login'])){
$username = htmlspecialchars(trim($_POST['username']));
$password = $_POST['password'];

$stmt = $pdo->prepare("SELECT * FROM users WHERE username = :username");
$stmt->execute(['username' => $username]);
$user = $stmt->fetch();

if($user && password_verify($password, $user['password'])){
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
echo "✅ Login successful! Welcome, " . $_SESSION['username'];
} else {
echo "❌ Invalid credentials!";
}
}
?>

âš¡ 5. Logout Page (logout.php)