{"id":2742,"date":"2021-09-25T11:19:29","date_gmt":"2021-09-25T11:19:29","guid":{"rendered":"https:\/\/phptutorial.net\/php-tutorial\/php-login\/"},"modified":"2025-04-09T07:58:43","modified_gmt":"2025-04-09T07:58:43","slug":"php-login","status":"publish","type":"page","link":"https:\/\/www.phptutorial.net\/php-tutorial\/php-login\/","title":{"rendered":"PHP Login"},"content":{"rendered":"\r\n

Summary<\/strong>: in this tutorial, you’ll learn how to create a login form using a username and password.<\/p>\r\n\r\n\r\n\r\n

Prerequisites #<\/a><\/h2>\r\n\r\n\r\n\r\n

To start this tutorial, you\u00a0must complete the\u00a0previous one<\/a><\/span>\u00a0that creates a registration form<\/a>.<\/p>\r\n\r\n\r\n\r\n

Introduction to the PHP login form #<\/a><\/h2>\r\n\r\n\r\n\r\n

In the previous tutorial, you learned how to create a form that allows users to register for accounts<\/a>. Once the users register successfully, you redirect them to the login page so that they can log in using their usernames and passwords.<\/p>\r\n\r\n\r\n\r\n

The login page will contain a form that consists of the username and password inputs and a login button as follows:<\/p>\r\n\r\n\r\n

\r\n
\"PHP<\/figure>\r\n<\/div>\r\n\r\n\r\n

To log in, users must enter their username and password and click the login button.<\/p>\r\n\r\n\r\n\r\n

If the username and password match, redirect them to a password-protected page. Otherwise, you redirect the users back to the login page with an error message:<\/p>\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n

Note that it’s more secure to issue a generic message (invalid username or password) when neither username nor password matches.<\/p>\r\n\r\n\r\n\r\n

Download the login form source code<\/a><\/p>\r\n\r\n\r\n\r\n

Create the login form #<\/a><\/h3>\r\n\r\n\r\n\r\n

First, create the login.php<\/code> page in the public<\/code> folder.<\/p>\r\n\r\n\r\n\r\n

Second, define a login form with the username and password inputs and a login button:<\/p>\r\n\r\n\r\n

<!DOCTYPE html<\/span>><\/span>\r\n<html<\/span> lang<\/span>=\"en\"<\/span>><\/span>\r\n<head<\/span>><\/span>\r\n    <meta<\/span> charset<\/span>=\"UTF-8\"<\/span>><\/span>\r\n    <meta<\/span> name<\/span>=\"viewport\"<\/span> content<\/span>=\"width=device-width, initial-scale=1.0\"<\/span>><\/span>\r\n    <link<\/span> rel<\/span>=\"stylesheet\"<\/span> href<\/span>=\"https:\/\/phptutorial.net\/app\/css\/style.css\"<\/span>><\/span>\r\n    <title<\/span>><\/span>Login<\/title<\/span>><\/span>\r\n<\/head<\/span>><\/span>\r\n<body<\/span>><\/span>\r\n<main<\/span>><\/span>\r\n    <form<\/span> action<\/span>=\"login.php\"<\/span> method<\/span>=\"post\"<\/span>><\/span>\r\n        <h1<\/span>><\/span>Login<\/h1<\/span>><\/span>\r\n        <div<\/span>><\/span>\r\n            <label<\/span> for<\/span>=\"username\"<\/span>><\/span>Username:<\/label<\/span>><\/span>\r\n            <input<\/span> type<\/span>=\"text\"<\/span> name<\/span>=\"username\"<\/span> id<\/span>=\"username\"<\/span>><\/span>\r\n        <\/div<\/span>><\/span>\r\n        <div<\/span>><\/span>\r\n            <label<\/span> for<\/span>=\"password\"<\/span>><\/span>Password:<\/label<\/span>><\/span>\r\n            <input<\/span> type<\/span>=\"password\"<\/span> name<\/span>=\"password\"<\/span> id<\/span>=\"password\"<\/span>><\/span>\r\n        <\/div<\/span>><\/span>\r\n        <section<\/span>><\/span>\r\n            <button<\/span> type<\/span>=\"submit\"<\/span>><\/span>Login<\/button<\/span>><\/span>\r\n            <a<\/span> href<\/span>=\"register.php\"<\/span>><\/span>Register<\/a<\/span>><\/span>\r\n        <\/section<\/span>><\/span>\r\n    <\/form<\/span>><\/span>\r\n<\/main<\/span>><\/span>\r\n<\/body<\/span>><\/span>\r\n<\/html<\/span>><\/span><\/code><\/span>Code language:<\/span> HTML, XML<\/span> (<\/span>xml<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Like the register.php<\/code> page, you can reuse the header.php<\/code> and footer.php<\/code> files from the src\/inc<\/code> folder and use the view()<\/code> function to load them to the login.php<\/code> page as follows:<\/p>\r\n\r\n\r\n
<?php<\/span>\r\n\r\nrequire<\/span> __DIR__<\/span> . '\/..\/src\/bootstrap.php'<\/span>;\r\n?><\/span>\r\n\r\n<?php<\/span> view('header'<\/span>, ['title'<\/span> => 'Login'<\/span>]) ?><\/span>\r\n<main>\r\n    <form action=\"login.php\"<\/span> method=\"post\"<\/span>>\r\n        <h1>Login<\/h1>\r\n        <div>\r\n            <label for<\/span>=\"username\"<\/span>>Username:<\/label>\r\n            <input type=\"text\"<\/span> name=\"username\"<\/span> id=\"username\"<\/span>>\r\n        <\/div>\r\n\r\n        <div>\r\n            <label for<\/span>=\"password\"<\/span>>Password:<\/label>\r\n            <input type=\"password\"<\/span> name=\"password\"<\/span> id=\"password\"<\/span>>\r\n        <\/div>\r\n\r\n        <section>\r\n            <button type=\"submit\"<\/span>>Login<\/button>\r\n            <a href=\"register.php\"<\/span>>Register<\/a>\r\n        <\/section>\r\n    <\/form>\r\n<\/main>\r\n<?php<\/span> view('footer'<\/span>) ?><\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
The login form is submitted to login.php<\/code>. Therefore, you can check if the HTTP request method is POST before processing the form.<\/p>\r\n\r\n\r\n\r\n
To process the form, you create the login.php<\/code> in the src<\/code> folder.<\/p>\r\n\r\n\r\n
<?php<\/span>\r\n\r\n$inputs = [];\r\n$errors = [];\r\n\r\nif<\/span> (is_post_request()) {\r\n\r\n    [$inputs, $errors] = filter($_POST, [\r\n        'username'<\/span> => 'string | required'<\/span>,\r\n        'password'<\/span> => 'string | required'<\/span>\r\n    ]);\r\n\r\n    if<\/span> ($errors) {\r\n        redirect_with('login.php'<\/span>, ['errors'<\/span> => $errors, 'inputs'<\/span> => $inputs]);\r\n    }\r\n\r\n    \/\/ if login fails<\/span>\r\n    if<\/span> (!login($inputs['username'<\/span>], $inputs['password'<\/span>])) {\r\n\r\n        $errors['login'<\/span>] = 'Invalid username or password'<\/span>;\r\n\r\n        redirect_with('login.php'<\/span>, [\r\n            'errors'<\/span> => $errors,\r\n            'inputs'<\/span> => $inputs\r\n        ]);\r\n    }\r\n    \/\/ login successfully<\/span>\r\n    redirect_to('index.php'<\/span>);\r\n\r\n} else<\/span> if<\/span> (is_get_request()) {\r\n    [$errors, $inputs] = session_flash('errors'<\/span>, 'inputs'<\/span>);\r\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
How it works.<\/p>\r\n\r\n\r\n\r\n
First, define two variables to store the sanitized data and error messages:<\/p>\r\n\r\n\r\n
$inputs = [];\r\n$errors = [];<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Second, check if the HTTP request method is POST using the is_post_request()<\/code> function:<\/p>\r\n\r\n\r\n
if<\/span> (is_post_request()) {\r\n    \/\/ ...<\/span>\r\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Third, sanitize and validate user inputs using the filter()<\/code> function:<\/p>\r\n\r\n\r\n
[$inputs, $errors] = filter($_POST, [\r\n    'username'<\/span> => 'string | required'<\/span>,\r\n    'password'<\/span> => 'string | required'<\/span>\r\n]);<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
if<\/span> ($errors) {\r\n    redirect_with('login.php'<\/span>, [\r\n        'errors'<\/span> => $errors,\r\n        'inputs'<\/span> => $inputs\r\n    ]);\r\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Fifth, call the login()<\/code> function to verify the username and password.<\/p>\r\n\r\n\r\n\r\n
If either username or password doesn’t match, set an error message with the key login<\/code> and redirect users back to the login.php<\/code> page:<\/p>\r\n\r\n\r\n
<?php<\/span>\r\n\r\nif<\/span> (!login($inputs['username'<\/span>], $inputs['password'<\/span>])) {\r\n\r\n    $errors['login'<\/span>] = 'Invalid username or password'<\/span>;\r\n\r\n    redirect_with('login.php'<\/span>, [\r\n        'errors'<\/span> => $errors,\r\n        'inputs'<\/span> => $inputs\r\n    ]);\r\n}<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Seventh, if both username and password match, redirect users to the index.php<\/code> page:<\/p>\r\n\r\n\r\n
redirect_to('index.php'<\/span>);<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
The index.php<\/code> is the password-protected page. Only logged-in users can access it\u2014more on this in the next section.<\/p>\r\n\r\n\r\n\r\n
Finally, get the $inputs<\/code> and $errors<\/code> from the session if the HTTP request method is GET.<\/p>\r\n\r\n\r\n
[$errors, $inputs] = session_flash('errors'<\/span>, 'inputs'<\/span>);<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Show the entered data & error message on the login.php page #<\/a><\/h3>\r\n\r\n\r\n\r\n
The public\/login.php<\/code> needs to change to the following to show the user inputs as well as error messages:<\/p>\r\n\r\n\r\n
<?php<\/span>\r\n\r\nrequire<\/span> __DIR__<\/span> . '\/..\/src\/bootstrap.php'<\/span>;\r\nrequire<\/span> __DIR__<\/span> . '\/..\/src\/login.php'<\/span>;\r\n?><\/span>\r\n\r\n<?php<\/span> view('header'<\/span>, ['title'<\/span> => 'Login'<\/span>]) ?><\/span>\r\n\r\n<?php<\/span> if<\/span> (isset<\/span>($errors['login'<\/span>])) : ?><\/span>\r\n    <div class<\/span>=\"alert<\/span> alert<\/span>-error<\/span>\">\r\n        <?= $errors<\/span>['login<\/span>'] ?>\r\n    <\/div<\/span>>\r\n<?php<\/span> endif<\/span> ?>\r\n\r\n    <form<\/span> action<\/span>=\"login<\/span>.php<\/span>\" method<\/span>=\"post<\/span>\">\r\n        <h1<\/span>>Login<\/span><\/h1<\/span>>\r\n        <div<\/span>>\r\n            <label<\/span> for<\/span>=\"username<\/span>\">Username<\/span>:<\/label<\/span>>\r\n            <input<\/span> type<\/span>=\"text<\/span>\" name<\/span>=\"username<\/span>\" id<\/span>=\"username<\/span>\" value<\/span>=\"<?= $inputs<\/span>['username<\/span>'] ?? '' ?>\">\r\n            <small<\/span>><?= $errors<\/span>['username<\/span>'] ?? '' ?><\/small<\/span>>\r\n        <\/div<\/span>>\r\n        <div<\/span>>\r\n            <label<\/span> for<\/span>=\"password<\/span>\">Password<\/span>:<\/label<\/span>>\r\n            <input<\/span> type<\/span>=\"password<\/span>\" name<\/span>=\"password<\/span>\" id<\/span>=\"password<\/span>\">\r\n            <small<\/span>><?= $errors<\/span>['password<\/span>'] ?? '' ?><\/small<\/span>>\r\n        <\/div<\/span>>\r\n        <section<\/span>>\r\n            <button<\/span> type<\/span>=\"submit<\/span>\">Login<\/span><\/button<\/span>>\r\n            <a<\/span> href<\/span>=\"register<\/span>.php<\/span>\">Register<\/span><\/a<\/span>>\r\n        <\/section<\/span>>\r\n    <\/form<\/span>>\r\n\r\n<?php<\/span> view<\/span>('footer<\/span>') ?><\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\r\n\r\n\r\n
Since the login()<\/code> function doesn’t exist, we need to define it.<\/p>\r\n\r\n\r\n\r\n
Define the login() function #<\/a><\/h2>\r\n\r\n\r\n\r\n
The login()<\/code> function accepts username and password and returns true if they are valid. The logic of the login()<\/code> function is as follows:<\/p>\r\n\r\n\r\n\r\n
Fourth, if either username or password is not provided, redirect users to the login.php<\/code> page using the post-redirect-get (PRG) technique<\/a> and set the $errors<\/code> and $inputs<\/code> in the session, using the redirect_with()<\/code> function.<\/p>\r\n\r\n\r\n