How To Create a Basic Login System with PHP and MySQL

Build a secure login system in under 30 minutes using PHP and MySQL , perfect for beginners learning authentication.

🔐 Why Build a Login System?

Most dynamic websites require a secure way to authenticate users. This tutorial shows you how to build a functional login system using PHP and MySQL without a framework. You'll learn how to safely verify credentials and manage sessions.

📦 Step 1: Create the MySQL Database

CREATE DATABASE login_demo; USE login_demo; CREATE TABLE users ( id INT AUTO_INCREMENT PRIMARY KEY, username VARCHAR(50) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL );

Insert a test user with hashed password:

INSERT INTO users (username, password) VALUES ('admin', '$2y$10$EXAMPLE.HASHED.PASSWORD');

You can use password_hash('yourpassword', PASSWORD_DEFAULT) in PHP to generate a secure hash.

🧾 Step 2: Create the Login Form (HTML)

<form action="login.php" method="post"> <label>Username:</label> <input type="text" name="username" required><br> <label>Password:</label> <input type="password" name="password" required><br> <button type="submit">Login</button> </form>

⚙️ Step 3: login.php (Authentication Logic)

<?php session_start(); require 'db.php'; // your PDO connection file if ($_SERVER['REQUEST_METHOD'] == 'POST') { $username = trim($_POST['username']); $password = $_POST['password']; $stmt = $pdo->prepare('SELECT * FROM users WHERE username = ?'); $stmt->execute([$username]); $user = $stmt->fetch(); if ($user && password_verify($password, $user['password'])) { $_SESSION['user'] = $user['username']; header('Location: dashboard.php'); exit; } else { echo 'Invalid credentials'; } } ?>

🧑‍💻 Step 4: Create dashboard.php

<?php session_start(); if (!isset($_SESSION['user'])) { header('Location: login.php'); exit; } ?> <h1>Welcome, <?= htmlspecialchars($_SESSION['user']) ?></h1> <a href="logout.php">Logout</a>

🚪 Step 5: Create logout.php

<?php session_start(); session_destroy(); header('Location: login.php'); exit; ?>

🛡️ Security Tips

• Always hash passwords using password_hash()
• Use https in production to encrypt login data
• Escape all output with htmlspecialchars()
• Use prepared statements to prevent SQL injection
• Regenerate session IDs upon login