Series 1 — Build a Complete PHP Authentication System - How to Create a Secure PHP Login System with MySQLi

 What readers will learn:

• Create users table
• Build login form
• Validate credentials
• Hash passwords
• Create PHP sessions
• Protect private pages
• Logout users

1. Create the database

CREATE DATABASE codexpress;

USE codexpress;

CREATE TABLE users (
    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    email VARCHAR(150) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    role ENUM('user', 'manager', 'admin') NOT NULL DEFAULT 'user',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

2. Connect PHP to MySQL 

config.php

 
$host = "localhost";
$username = "root";
$password = "";
$database = "codexpress";

$conn = new mysqli(
    $host,
    $username,
    $password,
    $database
);

if ($conn->connect_error) {
    die("Database connection failed.");
}

$conn->set_charset("utf8mb4");

Create the Registration Form

    

        Full Name

        
    

    

        Email Address

        
    

    

        Password

        
    

    

4. Process Registration

 
require_once "config.php";

$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$password = $_POST['password'] ?? '';

if (empty($name) || empty($email) || empty($password)) {
    die("All fields are required.");
}

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die("Invalid email address.");
}

if (strlen($password) < 8) {
    die("Password must contain at least 8 characters.");
}

$hashedPassword = password_hash(
    $password,
    PASSWORD_DEFAULT
);

$stmt = $conn->prepare(
    "INSERT INTO users (name, email, password)
     VALUES (?, ?, ?)"
);

$stmt->bind_param(
    "sss",
    $name,
    $email,
    $hashedPassword
);

if ($stmt->execute()) {
    echo "Registration successful.";
} else {
    echo "Unable to create account.";
}

5. Login Processing

 
session_start();

require_once "config.php";

$email = trim($_POST['email'] ?? '');
$password = $_POST['password'] ?? '';

$stmt = $conn->prepare(
    "SELECT id, name, password, role
     FROM users
     WHERE email = ?
     LIMIT 1"
);

$stmt->bind_param("s", $email);
$stmt->execute();

$result = $stmt->get_result();

if ($result->num_rows === 1) {

    $user = $result->fetch_assoc();

    if (password_verify($password, $user['password'])) {

        session_regenerate_id(true);

        $_SESSION['user_id'] = $user['id'];
        $_SESSION['name'] = $user['name'];
        $_SESSION['role'] = $user['role'];

        header("Location: dashboard.php");
        exit;
    }
}

echo "Invalid email or password.";

6. Protect the Dashboard

 

session_start();

if (!isset($_SESSION['user_id'])) {
    header("Location: login.php");
    exit;
} 

    Welcome, 

7. Logout

 
session_start();

$_SESSION = [];

session_destroy();

header("Location: login.php");
exit;