3 Steps Simple Login System In PHP (Without A Database)

Welcome to a quick tutorial on how to create a simple login system in PHP without a database. So you just want a simple login authentication without too much difficult technical stuff?

That is the gist of it, but let us walk through an actual example in this guide – Read on!

ⓘ I have included a zip file with all the source code at the start of this tutorial, so you don’t have to copy-paste everything… Or if you just want to dive straight in.

 

 

TLDR – QUICK SLIDES

Fullscreen Mode – Click Here

 

 

TABLE OF CONTENTS

 

 

QUICK NOTES

• Set your own users and passwords in $users of 2-check.php, also where to redirect on successful login.
• Protect all your pages by including 3-protect.php at the top.
• Launch 1-login.php in the web browser, that’s all.

If you spot a bug, feel free to comment below. I try to answer short questions too, but it is one person versus the entire world… If you need answers urgently, please check out my list of websites to get help with programming.

 

EXAMPLE CODE DOWNLOAD

Click here to download the source code, I have released it under the MIT license, so feel free to build on top of it or use it in your own project.

 

 

 

STEP 1) HTML LOGIN PAGE

<?php
// (A) LOGIN CHECKS
require "2-check.php";
 
// (B) LOGIN PAGE HTML
if (isset($failed)) { ?>
<div id="login-bad">Invalid user or password.</div>
<?php } ?>
 
<form id="login-form" method="post" target="_self">
  <h1>PLEASE SIGN IN</h1>
  <label for="user">User</label>
  <input type="text" name="user" required>
  <label for="password">Password</label>
  <input type="password" name="password" required>
  <input type="submit" value="Sign In">
</form>

This should be self-explanatory, just a simple HTML login form – When the login form is submitted, require "2-check.php" will take over and do the actual login processing.

 

STEP 2) PHP LOGIN PROCESS

<?php
// (A) START SESSION 
session_start();
 
// (B) PROCESS LOGIN
if (isset($_POST["user"]) && !isset($_SESSION["user"])) {
  // (B1) USERS & PASSWORDS - SET YOUR OWN !
   $users = [
    "joe" => "123456",
    "jon" => "654321",
    "joy" => "987654"
  ];
 
  // (B2) CHECK & VERIFY
  if (isset($users[$_POST["user"]]) && $users[$_POST["user"]] == $_POST["password"]) {
    $_SESSION["user"] = $_POST["user"];
  }
 
  // (B3) FAILED LOGIN FLAG
  if (!isset($_SESSION["user"])) { $failed = true; }
}
 
// (C) REDIRECT TO HOME PAGE IF SIGNED IN - SET YOUR OWN !
if (isset($_SESSION["user"])) {
  header("Location: 4-dummy.php");
  exit();
}

1. Start the session, this is an essential part of login systems.
2. As in the introduction. There is no database, so we keep the users in the $users array instead. Simply do a check against this array on login and register the user in $_SESSION["user"] on a valid check.
3. Redirect the user to the home page if properly signed in.

 

 

STEP 3) PROTECT ALL OTHER PAGES

<?php
// (A) START SESSION
session_start();
 
// (B) LOGOUT REQUEST
if (isset($_POST["logout"])) {
  session_destroy();
  unset($_SESSION);
}
 
// (C) REDIRECT TO LOGIN PAGE IF NOT LOGGED IN
if (!isset($_SESSION["user"])) {
  header("Location: 1-login.php");
  exit();
}

To protect all the pages that require a valid login, simply require "3-protect.php" at the very top. Very simple snippet:

1. Start the session.
2. For logging users out. Simply create a form that submits $_POST["logout"] to itself (see below), this will destroy and close the current session.
3. Remember that only logged-in users will have $_SESSION["user"]? We do a check here if this flag exists, and throw all users that are not logged in back to the login page.

 

EXTRA) HOW TO LOGOUT?

<form method="post">
  <input type="hidden" name="logout" value="1">
  <input type="submit" value="Sign Out">
</form>

Just add a simple form to submit $_POST["logout"]=1, this will trigger if (isset($_POST["logout"])) { CLOSE/DESTROY SESSION }.

 

 

 

ALTERNATIVE – HTACCESS PASSWORD

This is an alternative way to add passwords without the use of PHP or databases, but it will only work on Apache servers.

1. Create a .htpasswd file to store the password. Just do a “htpasswd generator” search on the Internet, and that will give you plenty of generators online that you can use –
   • Web2.0Generators
   • HTAccessTools
   • Dynamic Drive
2. Next, create a .htaccess file in the folder that you want to protect.
   • AuthType Basic
   • AuthName "Secret Ninja Zone"
   • AuthUserFile PATH/TO/.htpasswd
   • Require valid-user

 

 

PROTECT YOUR PASSWORDS!

<?php
// GET ENCRYPTED PASSWORD
// COPY-PASTE ENCRYPTED PASSWORD INTO 2-CHECK.PHP (B1)
echo password_hash("YOUR-PASSWORD", PASSWORD_DEFAULT);

// TO VERIFY PASSWORD - MODIFY 2-CHECK.PHP (B2) 
if (password_verify($_POST["password"], $users[$_POST["user"]])) { .... }

Yes, it’s a simple system, but at least encrypt your passwords. It’s not as difficult as some may think…

 

ABLE TO ACCESS PROTECTED PAGES AFTER SIGNING OUT

Well, the culprit is probably the browser cache. For those who are new – Browsers usually keep a copy of pages to speed up loading time and for offline support. It’s a cool little mechanism, but it also causes problems with login/logout at times… A possible Javascript solution, credits to web.dev:

window.addEventListener("pageshow", event => {
  if (event.persisted && !document.cookie.match(/PHPSESSID/)) {
    // Force a reload if the user has logged out.
    location.reload();
  }
});

 

LINKS & REFERENCES

• Simple Ways To Encrypt Decrypt Passwords – Code Boxx
• Simple AJAX User Login Page (With PHP MySQL) – Code Boxx
• Cookies and Sessions in PHP – Code Boxx
• Apache htpasswd

 

TUTORIAL VIDEO

 

INFOGRAPHIC CHEAT SHEET