Member Avatar for timbredemeyer

I am desperate for some password protection that accesses a database for user name and password. i have searched all over the web and cannot find one that actualy works. i need to redirect to a users personal internal page on my website after the password checks out as well. any help would be greatly appreciated. thank you in advance.

  • 2 Contributors
  • 3 Replies
  • 84 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Member #114696

Dani AI

Generated

asked for a DB-backed login that redirects to a personal internal page; was right to point toward server-side auth and sessions. A compact, secure pattern that avoids the usual broken-script pitfalls follows.

This pattern uses PDO prepared statements, stores only hashed passwords with PHP's password_hash() and checks them with password_verify(). After successful verification the session is started, the session id is regenerated, and a short session marker (for example $_SESSION['user_id']) is set before performing a Location redirect.

<?php
// login.php (minimal)
require 'config.php'; // creates $pdo
session_start();

$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = ? LIMIT 1');
$stmt->execute([$_POST['username'] ?? '']);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($_POST['password'] ?? '', $user['password_hash'])) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
    header('Location: /users.php'); // protected page reads $_SESSION['user_id']
    exit;
}

header('Location: /login.php?error=1');
exit;
?>

Troubleshooting notes: ensure no output before session_start()/header(), verify session.save_path is writable, check that the browser accepts cookies, and enable error logging while developing. Force HTTPS, set Secure/HttpOnly/SameSite on session cookies, avoid MD5/plaintext, implement rate-limiting/account lockouts, and enforce session checks on every protected page. See PHP: password_hash documentation and the OWASP Authentication Cheat Sheet for up-to-date best practices.

Recommended Answers

All 3 Replies

Member Avatar for Member #114696

You will perhaps need to use a server-side language like PHP, ASP etc etc.... Tell us which one you use.

Member Avatar for timbredemeyer

You will perhaps need to use a server-side language like PHP, ASP etc etc.... Tell us which one you use.

I have been looking at php scripts but none of them actualy seem to work. i have been trying to figure this out for about 2 weeks and just came across this forum and seems like a nice group of people here.

Member Avatar for Member #114696

You need to use session and cookies. You better ask OP to move this thread to PHP forums. You'll get appropriate help there.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.