[TUTORIAL]: Making a member’s area in PHP and MySQL

I am going to show you how to make a simple membership system. This included, registering for an account, logging in, security for pages, and logging out.

Now shall we begin? I say yes!

Our database will be setup like the following:

CREATE TABLE IF NOT EXISTS `users` (
`user_id` int(11) NOT NULL auto_increment,
`username` varchar(225) NOT NULL default '',
`password` varchar(225) NOT NULL default '',
`email` varchar(225) NOT NULL default '',
PRIMARY KEY  (`user_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 AUTO_INCREMENT=1;

Breakdown:
user_id is the default value that keeps track of users.
username is the users log in name.
password is the users log in password.
email is the users email, so in later versions of the member system, a forgot password can be added.

Our 1st bit of code will be a file named conf.inc.php. This file holds all of our mysql and function data, so we don’t have to enter it over and over

conf.inc.php

<?php
$db_user = ""; // Username
$db_pass = ""; // Password
$db_database = ""; // Database Name
$db_host = ""; // Server Hostname
$db_connect = mysql_connect ($db_host, $db_user, $db_pass); // Connects to the database.
$db_select = mysql_select_db ($db_database); // Selects the database
function form($data) { // Prevents SQL Injection
global $db_connect;
$data = ereg_replace("[\'\")(;|`,&lt;&gt;]", "", $data);
$data = mysql_real_escape_string(trim($data), $db_connect);
return stripslashes($data);
}
?>

Breakdown:
The 1st part is all the mySQL information in order to view and insert data.
The 2nd part prevents SQL injection, so people cant gain unauthorized access.

Our next file will be register.php, it will allow users to register an account so they may login and view parts of the website that others cant.

register.php

<?php
include("conf.inc.php"); // Includes the db and form info.
session_start(); // Starts the session.
if ($_SESSION['logged'] == 1) { // User is already logged in.
    header("Location: index.php"); // Goes to main page.
    exit(); // Stops the rest of the script.
} else {
    if (!isset($_POST['submit'])) { // The form has not been submitted.
echo <<<login
               <form action="login.php" method="POST">
        <table>
        <tr>
        <td colspan="2">Login:</td>
        </tr>
        <tr>
        <td width="50%">Username:</td><td width="50%"><input name="username" size="18" type="text" />
        </tr>
        <tr>
        <td width="50%">Password:</td><td width="50%"><input name="password" size="18" type="text" />
        </tr>
        <tr>
        <td colspan="2"><input type="submit" name="submit" value="submit"</td>
        </tr>
        </table>
        </form>
login;
    } else {
        $username = form($_POST['username']);
        $password = md5($_POST['password']); // Encrypts the password.

        $q = mysql_query("SELECT * FROM `users` WHERE username = '$username' AND password = '$password'") or die (mysql_error()); // mySQL query
        $r = mysql_num_rows($q); // Checks to see if anything is in the db.

        if ($r == 1) { // There is something in the db. The username/password match up.
            $_SESSION['logged'] = 1; // Sets the session.
            header("Location: index.php"); // Goes to main page.
            exit(); // Stops the rest of the script.
        } else { // Invalid username/password.
            exit("Incorrect username/password!"); // Stops the script with an error message.
        }
    }
}
mysql_close($db_connect); // Closes the connection.
?>

Breakdown:
We 1st include the database details and make sure the form has not been submitted. If it has not been submitted then we display the register form.
If the form is submitted, we make some variables so we can incorporate the form() function.
We then make sure that the users email or user name are not already in the database.
Then we insert the user into the database and redirect them to the login page.

PS: Heredoc syntax is used instead of having like 20 echo ” ‘s

The next page is login.php.

login.php

<?php
include("conf.inc.php"); // Includes the db and form info.
session_start(); // Starts the session.
if ($_SESSION['logged'] == 1) { // User is already logged in.
header("Location: index.php"); // Goes to main page.
exit(); // Stops the rest of the script.
} else {
if (!isset($_POST['submit'])) { // The form has not been submitted.
echo &lt;&lt;

<form action="login.php" method="POST">
<table>
<tbody>
<tr>
<td colspan="2">Login:</td>
</tr>
<tr>
<td width="50%">Username:</td>
<td width="50%"><input name="username" size="18" type="text" /></td>
</tr>
<tr>
<td width="50%">Password:</td>
<td width="50%"><input name="password" size="18" type="text" /></td>
</tr>
<tr>
<td colspan="2"><input name="submit" type="submit" value="submit" /></td>
</tr>
</tbody>
</table>
</form>login;
} else {
$username = form($_POST['username']);
$password = md5($_POST['password']); // Encrypts the password.

$q = mysql_query("SELECT * FROM `users` WHERE username = '$username' AND password = '$password'") or die (mysql_error()); // mySQL query
$r = mysql_num_rows($q); // Checks to see if anything is in the db.

if ($r == 1) { // There is something in the db. The username/password match up.
$_SESSION['logged'] = 1; // Sets the session.
header("Location: index.php"); // Goes to main page.
exit(); // Stops the rest of the script.
} else { // Invalid username/password.
exit("Incorrect username/password!"); // Stops the script with an error message.
}
}
}
mysql_close($db_connect); // Closes the connection.
?&gt;

Breakdown:
1st we include the db and function file, and start the session, telling the browser that sessions will be used.
We then make sure the form has not been submitted in order to show the login form.
If the form has been submitted we make 2 variables for user name and password. We encrypt the password with md5() so it is a bit more secure. (To all those who are experts in PHP, you would normally salt a password to make it harder to crack, but for beginners stick with md5())
We then have a query checking the database if any users match the use rname and password, and if there are matches it will be counted in $r.
If there are matches we set a login session.

Now we will make logout.php.

logout.php

<?php
session_unset(); // Destroys the session.
header("Location: login.php"); // Goes back to login.
?>

Breakdown:
We destroy all sessions and forward the user to the login page.

And last but not least, the page where you want only logged in users to view.

index.php

include("conf.inc.php"); // Includes the db and form info.
session_start(); // Starts the session.
if ($_SESSION['logged'] != 1) { // There was no session found!
header("Location: login.php"); // Goes to login page.
exit(); // Stops the rest of the script.
}
else{
include('include_a_page_for_the_member_to_see.php');
echo "Or just use HTML!";
echo "<a href="\">Logout?</a>";
}
?&gt;