PHP Security

Never store user passwords as plain text. PHP provides password_hash() to create password hashes and password_verify() to check passwords.

Creating a password hash:

<?php
$password = $_POST["password"] ?? "";

if ($password === "") {
    exit("Password is required.");
}

$hash = password_hash(
    $password,
    PASSWORD_DEFAULT
);

// Store $hash in the database.
// Never store the original password.
?>

Verifying a password during login:

<?php
$password = $_POST["password"] ?? "";
$storedHash = $user["password_hash"];

if (password_verify($password, $storedHash)) {
    echo "Password is correct.";
} else {
    echo "Invalid login credentials.";
}
?>

The second example assumes that $user["password_hash"] was retrieved from a trusted database record.

Use a database column large enough for password hashes, such as VARCHAR(255). Never log passwords, and use rate limiting to reduce repeated login attempts.

This example demonstrates prepared statements, password verification, session regeneration, and a generic login failure message.

It assumes a PDO connection named $pdo and a database table containing id, email, and password_hash columns.

<?php
session_set_cookie_params([
    "lifetime" => 0,
    "path" => "/",
    "secure" => true,
    "httponly" => true,
    "samesite" => "Lax"
]);

session_start();

$error = "";

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $email = $_POST["email"] ?? "";
    $password = $_POST["password"] ?? "";

    if (
        !is_string($email) ||
        !is_string($password) ||
        !filter_var($email, FILTER_VALIDATE_EMAIL)
    ) {
        $error = "Invalid email or password.";
    } else {
        try {
            $stmt = $pdo->prepare(
                "SELECT id, password_hash
                 FROM students
                 WHERE email = :email
                 LIMIT 1"
            );

            $stmt->execute([
                "email" => $email
            ]);

            $user = $stmt->fetch(PDO::FETCH_ASSOC);

            if (
                $user &&
                password_verify(
                    $password,
                    $user["password_hash"]
                )
            ) {
                session_regenerate_id(true);

                $_SESSION["student_id"] = (int) $user["id"];

                header("Location: student_dashboard.php");
                exit;
            }

            $error = "Invalid email or password.";

        } catch (PDOException $e) {
            error_log($e->getMessage());

            $error = "Login is temporarily unavailable.";
        }
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Student Login</title>
</head>
<body>

    <h2>Student Login</h2>

    <?php if ($error !== ""): ?>
        <p style="color: red;">
            <?= htmlspecialchars(
                $error,
                ENT_QUOTES | ENT_SUBSTITUTE,
                "UTF-8"
            ) ?>
        </p>
    <?php endif; ?>

    <form method="post">
        <label for="email">Email:</label>
        <input
            type="email"
            id="email"
            name="email"
            required
        >

        <br><br>

        <label for="password">Password:</label>
        <input
            type="password"
            id="password"
            name="password"
            required
        >

        <br><br>

        <button type="submit">Login</button>
    </form>

</body>
</html>

Security requirements for a real application:

• Use HTTPS and secure session configuration.
• Add rate limiting and appropriate login monitoring.
• Use CSRF protection for relevant state-changing forms.
• Check authorization on every protected page.
• Ensure the database stores password hashes, not plain-text passwords.
• Regenerate the session ID after successful authentication.
• Use generic login errors to reduce account enumeration.

The example illustrates core techniques, but it is not a complete production authentication system.