Authentication with PHP and SQL
- To authenticate users with a login form.
A Database-less Login Form
Below is a simple login form that uses a hard-coded username and password.
Code Sample: Authentication/Demos/SimpleLogin.php
<html>
<head>
<title>Login Page</title>
</head>
<body>
<?php
require 'Includes/Header.php';
$msg='';
$Email = '';
if (array_key_exists('LoggingIn',$_POST))
{
$Email = $_POST['Email'];
$PW = $_POST['Password'];
if ($Email == 'jwayne@northwind.com' && $PW == 'cowboy')
{
echo '<div align="center">Success</div>';
}
else
{
echo '<div align="center">Login Failed</div>';
unset($_POST['LoggingIn']);
}
}
if (!array_key_exists('LoggingIn',$_POST))
{
?>
<div align="center">
<h2>Log in</h2>
<form method="post" action="SimpleLogin.php">
<input type="hidden" name="LoggingIn" value="true">
<table>
<tr>
<td>Email:</td>
<td><input type="text" name="Email"
value="<?php echo $Email?>" size="25"></td>
</tr>
<tr>
<td>Password:</td>
<td>
<input type="password" name="Password" size="10">
</td>
</tr>
<tr>
<td align="right" colspan="2">
<input type="submit" value="Log in">
</td>
</tr>
</table>
</form>
</div>
<?php
}
require 'Includes/Footer.php';
?>
</body>
</html>
This page contains an HTML login form, which submits to itself (i.e, the action points to the same page). A hidden field, LoggingIn, is passed to the server when the user submits the form. The script checks to see if LoggingIn exists in the $_POST array. If it does, it processes the form input:
$Email = $_POST['Email']; $PW = $_POST['Password']; if ($Email == 'jwayne@northwind.com' && $PW == 'cowboy') { echo '<div align="center">Success</div>'; } else { echo '<div align="center">Login Failed</div>'; unset($_POST['LoggingIn']); }This code simply checks to see if the user's email and password match the hard-coded values (jwayne@northwind.com and cowboy). If they do, it outputs a "success" message. If they don't, it outputs a "failed" message and removes LoggingIn from the $_POST array, so that the form will be displayed again.
Authentication with PHP and SQL Conclusion
In this lesson of the PHP tutorial, you have learned how to authenticate users. Unfortunately, as it is currently written, only the index page itself is protected. To protect the whole site in this manner, we would have to force the user to log in to every page. That might frustrate our visitors a bit, so we'll learn how to allow users to log in to the whole site later in the course.