Member Avatar for bobocop

Hi, Doe's anyone know how I can add a register and login page to my website.
or point me to a step by step tut on how to do it :?:

Thanks

  • 3 Contributors
  • 2 Replies
  • 108 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by bulldozerisme

Dani AI

Generated

As asked about adding registration/login and and gave initial pointers, the items below fill in the practical gaps most beginners miss: concrete security controls, the account lifecycle, and simple UX rules that make an auth system safe and usable.

  • Use TLS for every page that touches credentials.
  • Store only password hashes (use a modern adaptive algorithm and per-password salts) and never log raw passwords.
  • Make account activation and password reset use single-use, time-limited tokens; store only token hashes server-side.
  • Protect sessions: rotate session identifiers on privilege change, set cookies with HttpOnly, Secure and SameSite attributes, and expire them on inactivity.
  • Throttle and back off after failed logins; implement temporary lockouts to slow brute-force attacks.
  • Avoid user enumeration in responses (generic error text), but balance that with UX (clear guidance for recovery flows).
  • Defend against CSRF and XSS: CSRF tokens for state-changing requests and proper output encoding.
  • Use parameterized queries / an ORM to eliminate injection risks.
  • Log auth events for monitoring, but never write passwords or full tokens to logs.

A straightforward implementation workflow:

  • Design a users table with fields such as:
    id, email (unique), password_hash, created_at, last_login,
is_active, verification_token_hash, reset_token_hash,
failed_login_count, lock_expires_at
  • Registration: validate input, create the user with is_active=false, generate a crypto-random token, send it via email, store only the token hash.
  • Activation: verify token by comparing hashes, flip is_active.
  • Login: check is_active and lock_expires_at, verify password hash, reset failed count, create a secure session.
  • Password reset: issue time-limited token, verify, then replace stored hash and invalidate existing sessions.

For authoritative, detailed guidance on safe authentication and password handling, see OWASP’s cheat sheets: Authentication Cheat Sheet and Password Storage Cheat Sheet.

Recommended Answers

All 2 Replies

Member Avatar for Dani

If you just want to password protect a section of your site, this can be done with an .htaccess file. However, if you want a full-scale registration / login type thing, you'll need to use a scripting language such as PHP.

Member Avatar for bulldozerisme

Pretty simple. Use a scripting language that your web server can handle. eg. ASP for IIS, JSP/Servlet for tomcat Perl/CGI or PHP for Apache. and use a database at the back. you can also use a .htaccess file and have a script to register the users.

cheers

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.