A clean, secure, framework-free authentication system built in pure PHP.
"Security isn't a feature — it's a foundation. Build it right from day one."
- About
- Features
- Tech Stack
- Project Structure
- Auth Flow
- Getting Started
- Database Setup
- Usage
- Security
- Roadmap
- Contributing
- Author
User Auth System (PHP) is a clean, modular authentication system built from scratch in native PHP — no Laravel, no Symfony, no magic. It covers the entire authentication lifecycle: register, login, session management, and logout, with security best practices baked in from the ground up.
Perfect for developers who want to:
- 🎓 Learn how PHP auth actually works under the hood
- 🏗️ Use it as a base for larger PHP applications
- 🔐 Understand password hashing, sessions, and PDO in practice
| Feature | Details |
|---|---|
| 📝 Registration | Create a new account with username, email & password |
| 🔑 Login | Authenticate with email/username + password |
| 🚪 Logout | Cleanly destroy session and redirect to login |
| 🔒 Password Hashing | password_hash() with PASSWORD_BCRYPT — never plain-text |
| ✅ Password Verify | password_verify() for secure comparison |
| 🎫 Session Management | PHP $_SESSION with session ID regeneration on login |
| 🛡️ SQL Injection Safe | PDO prepared statements throughout |
| 🧹 Input Sanitization | Server-side validation on all form inputs |
| 💅 Custom CSS UI | Clean, hand-crafted stylesheet — no framework dependency |
| 🔐 Protected Pages | Session guard pattern to restrict access to auth-only pages |
| Layer | Technology |
|---|---|
| Backend | PHP 7.4+ (native, OOP) |
| Database | MySQL / MariaDB via PDO |
| Frontend | HTML5 + Custom CSS (20.7% of the codebase) |
| Session | PHP $_SESSION (server-side) |
| Password | PHP password_hash() / password_verify() |
| Server | Apache / Nginx / PHP built-in server |
user-auth-system-php/
│
├── 📂 public/ # Web-accessible entry points
│ ├── index.php # 🏠 Home / landing page (protected)
│ ├── login.php # 🔑 Login form & handler
│ ├── register.php # 📝 Registration form & handler
│ ├── dashboard.php # 📊 Protected dashboard (session-guarded)
│ └── logout.php # 🚪 Session destroy & redirect
│
├── 📂 includes/ # Core reusable PHP logic
│ ├── db.php # 🗄️ PDO database connection
│ ├── auth.php # 🛡️ Session guard / requireLogin()
│ └── functions.php # 🔧 Helper utilities (validate, sanitize)
│
├── 📂 css/ # Custom stylesheets
│ └── style.css # 🎨 Auth UI styles (login, register forms)
│
├── .gitignore
├── LICENSE
└── README.md
┌─────────────────────────────────────────────────────┐
│ User visits site │
└──────────────────────────┬──────────────────────────┘
│
┌──────────────▼──────────────┐
│ Session already active? │
└──────┬───────────────┬───────┘
YES NO
│ │
▼ ▼
┌────────────┐ ┌────────────────┐
│ Dashboard │ │ Login / Reg. │
└─────┬──────┘ └───────┬────────┘
│ │
│ ┌────────▼────────┐
│ │ Validate Input │
│ └────────┬────────┘
│ │
│ ┌────────▼────────────────┐
│ │ PDO Query (prepared stm) │
│ └────────┬────────────────┘
│ │
│ ┌────────▼────────────────┐
│ │ password_verify() check │
│ └────────┬────────────────┘
│ │
│ ┌────────▼───────────────────┐
│ │ session_regenerate_id(true) │
│ │ + $_SESSION['user'] = ... │
│ └────────┬───────────────────┘
│ │
└──────────────────▼
Dashboard ✅
│
[Logout clicked]
│
session_unset() + session_destroy()
│
Login page 🔄
- ✅ PHP 7.4+ with PDO & PDO_MySQL extensions enabled
- ✅ MySQL 5.7+ or MariaDB
- ✅ Apache (with
mod_rewrite) or Nginx - ✅ XAMPP / WAMP / LAMP or any local PHP stack
# 1. Clone the repository
git clone https://github.com/MisaghMomeniB/user-auth-system-php.git
# 2. Navigate into the project
cd user-auth-system-php
# 3. Run with the PHP built-in server (quickest way)
php -S localhost:8000 -t public/
# OR place in your web server root
# e.g. XAMPP: C:/xampp/htdocs/user-auth-system-php/Then open: http://localhost:8000
-- 1. Create the database
CREATE DATABASE user_auth_db;
USE user_auth_db;
-- 2. Create the users table
CREATE TABLE users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) NOT NULL UNIQUE,
email VARCHAR(150) NOT NULL UNIQUE,
password_hash VARCHAR(255) NOT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);Then configure your connection in includes/db.php:
$host = 'localhost';
$dbname = 'user_auth_db';
$user = 'your_db_user';
$pass = 'your_db_password';
$pdo = new PDO("mysql:host=$host;dbname=$dbname;charset=utf8", $user, $pass);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);Visit /register.php → fill in username, email, and password → submit.
The password is immediately hashed with password_hash() before being stored — raw passwords never touch the database.
Visit /login.php → enter your credentials → on success, session is started and you're redirected to the dashboard.
/dashboard.php is protected by a session guard. Any unauthenticated visitor is automatically redirected back to /login.php.
// Session guard pattern used on protected pages
require_once '../includes/auth.php';
requireLogin(); // Redirects to login.php if not authenticatedClick the Logout button — this calls /logout.php, which destroys all session data and redirects to the login page.
This project implements multiple layers of security:
| Threat | Protection Used |
|---|---|
| SQL Injection | PDO prepared statements — zero raw SQL string building |
| Password Exposure | password_hash(PASSWORD_BCRYPT) — one-way hashing |
| Password Comparison | password_verify() — timing-safe comparison |
| Session Hijacking | session_regenerate_id(true) on every successful login |
| XSS | htmlspecialchars() on all output variables |
| Unauthorized Access | Session guard (requireLogin()) on all protected pages |
⚠️ For production use, also consider: HTTPS enforcement, CSRF token protection, login rate limiting, account lockout after failed attempts, and secure cookie flags (HttpOnly,Secure,SameSite).
- User registration with hashed password
- Secure login & session management
- Session guard for protected pages
- Logout with full session destruction
- PDO prepared statements
- Custom CSS UI
- 🔁 Password reset via email link
- 📧 Email verification on registration
- 🚫 Login throttling / account lockout
- 🔑 "Remember Me" persistent login (secure cookie)
- 🛡️ CSRF token protection
- 👤 User profile page & avatar upload
- 🔐 Two-Factor Authentication (2FA)
- 🐳 Docker + docker-compose support
- 🧪 Unit tests for Auth & DB layers
Contributions are always welcome — especially security improvements!
- Fork the repository
- Create your branch:
git checkout -b feature/your-feature - Commit with clear messages:
git commit -m "Add: feature description" - Push:
git push origin feature/your-feature - Open a Pull Request with a clear description of what you changed and why
Please keep security in mind with every change — this is an auth system after all. 🔐
Distributed under the MIT License — free to use, learn from, and build upon.
See LICENSE for full details.
