Account created successfully.
"; ``` The completed section should look like: ```php if ($_SERVER["REQUEST_METHOD"] == "POST") { $username = $_POST["username"]; $password = $_POST["password"]; $hashedPassword = password_hash( $password, PASSWORD_DEFAULT ); $stmt = $conn->prepare( "INSERT INTO users (username, password) VALUES (?, ?)" ); $stmt->bind_param( "ss", $username, $hashedPassword ); $stmt->execute(); echo "Account created successfully.
"; } ``` --- ## Create a New User Account Open: ```text http://localhost/register.php ``` Enter: ```text Username: testuser Password: mypassword ``` Click **Register**. You should see: ```text Account created successfully. ``` ## Check the Database Open phpMyAdmin and view the users table. Run: ```sql SELECT * FROM users; ``` You should now see the new account. Example: | user_id | username | password | | ------- | -------- | ---------- | | 1 | admin | $2y$10$... | | 2 | teacher | $2y$10$... | | 3 | testuser | $2y$10$... | Notice that the password is stored as a hash rather than plain text. [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780894149294.png) ## Complete Code ```php connect_error) { die("Connection failed: " . $conn->connect_error); } if ($_SERVER["REQUEST_METHOD"] == "POST") { $username = $_POST["username"]; $password = $_POST["password"]; $hashedPassword = password_hash( $password, PASSWORD_DEFAULT ); $stmt = $conn->prepare( "INSERT INTO users (username, password) VALUES (?, ?)" ); $stmt->bind_param( "ss", $username, $hashedPassword ); $stmt->execute(); echo "Account created successfully.
"; } ?>User not found.
"; } ``` If the username exists, the user's record is loaded from the database. --- ## Verify the Password Inside the successful login section, add: ```php if ( password_verify( $password, $user["password"] ) ) { echo "Login successful.
"; } else { echo "Incorrect password.
"; } ``` This compares the entered password against the stored password hash. --- ## Complete Login Logic Your completed login section should look like: ```php if ($_SERVER["REQUEST_METHOD"] == "POST") { $username = $_POST["username"]; $password = $_POST["password"]; $stmt = $conn->prepare( "SELECT * FROM users WHERE username = ?" ); $stmt->bind_param( "s", $username ); $stmt->execute(); $result = $stmt->get_result(); if ($result->num_rows == 1) { $user = $result->fetch_assoc(); if ( password_verify( $password, $user["password"] ) ) { echo "Login successful.
"; } else { echo "Incorrect password.
"; } } else { echo "User not found.
"; } } ``` --- ## Test a Successful Login Open: ```text http://localhost/login.php ``` Enter a username and password that already exist in the database. Example: ```text Username: admin Password: password123 ``` Click **Login**. You should see: ```text Login successful. ``` [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780894384204.png) ## Test an Incorrect Password Enter: ```text Username: admin Password: wrongpassword ``` Click **Login**. You should see: ```text Incorrect password. ``` [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780894428828.png) ## Test an Unknown User Enter: ```text Username: unknownuser Password: password123 ``` Click **Login**. You should see: ```text User not found. ``` [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780894454026.png) ## Complete Code ```php connect_error) { die("Connection failed: " . $conn->connect_error); } if ($_SERVER["REQUEST_METHOD"] == "POST") { $username = $_POST["username"]; $password = $_POST["password"]; $stmt = $conn->prepare( "SELECT * FROM users WHERE username = ?" ); $stmt->bind_param( "s", $username ); $stmt->execute(); $result = $stmt->get_result(); if ($result->num_rows == 1) { $user = $result->fetch_assoc(); if ( password_verify( $password, $user["password"] ) ) { echo "Login successful.
"; } else { echo "Incorrect password.
"; } } else { echo "User not found.
"; } } ?>Login successful.
"; } ``` When a user logs in successfully, their information is now stored in the session. --- ## Create a Members Page Create a new file called: ```text members.php ``` Add the following code: ```phpWelcome,
``` Save the file. --- ## Open the Members Page Visit: ```text http://localhost/members.php ``` If you have logged in successfully, you should see: ```text Members Area Welcome, admin ``` or whatever username was used to log in. [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780894712588.png) ## Display Additional Session Information You can access any values stored in the session. For example: ```phpUser ID:
``` Result: ```text User ID: 1 ``` --- ## View the Session Data Add the following code to the members page: ```php``` Example output: ```text Array ( [user_id] => 1 [username] => admin ) ``` This can be useful when testing. ## Redirect Users After Login Instead of displaying: ```php echo "
Login successful.
"; ``` replace the success code with: ```php $_SESSION["user_id"] = $user["user_id"]; $_SESSION["username"] = $user["username"]; header("Location: members.php"); exit(); ``` Now users will be automatically redirected to the members page after a successful login. --- ## Test the Complete Process 1. Open: ```text http://localhost/login.php ``` 2. Log in using an existing account. 3. You should be redirected to: ```text http://localhost/members.php ``` 4. The page should display your username. > **Screenshot Placeholder** > > Insert screenshot showing the successful login redirect. --- ## Complete Login Success Code ```php if ( password_verify( $password, $user["password"] ) ) { $_SESSION["user_id"] = $user["user_id"]; $_SESSION["username"] = $user["username"]; header("Location: members.php"); exit(); } ``` --- ## Complete Members Page ```phpWelcome,
User ID:
``` You now have a working login system that remembers users between pages using PHP sessions. Next tutorial: **Protecting Pages and Preventing Unauthorised Access**. # Protecting Pages and Preventing Unauthorised Access In the previous tutorial, you used PHP sessions to remember who was logged in. In this tutorial, you will prevent users from accessing protected pages unless they have successfully logged in. --- ## The Problem Currently, anyone can access: ```text http://localhost/members.php ``` even if they have not logged in. To secure the page, we need to check whether a valid session exists before displaying any content. --- ## Open the Members Page Open: ```text members.php ``` Your page should currently begin with: ```php ``` --- ## Check if the User is Logged In Add the following code immediately after `session_start()`: ```php if (!isset($_SESSION["user_id"])) { header("Location: login.php"); exit(); } ``` Your page should now begin with: ```php ``` This checks whether the session contains a `user_id`. If it does not, the user is redirected to the login page. --- ## Test the Protection Open a private or incognito browser window. Attempt to visit: ```text http://localhost/members.php ``` Instead of seeing the members page, you should be redirected to: ```text http://localhost/login.php ``` ## Test After Logging In Log in using a valid account. Example: ```text Username: admin Password: password123 ``` After logging in, you should be redirected to: ```text http://localhost/members.php ``` The page should display your username. ## Create a Second Protected Page Create a new file called: ```text settings.php ``` Add the following code: ```phpOnly logged-in users can view this page.
``` Save the file. --- ## Test the Settings Page Visit: ```text http://localhost/settings.php ``` If you are logged in, the page should load. If you are not logged in, you should be redirected to the login page. ## Reusing the Protection Code Any page that should require a login can use the same code: ```php ``` Examples: ```text members.php settings.php profile.php dashboard.php ``` --- ## Complete Protected Members Page ```phpWelcome,
User ID:
``` You now have pages that can only be accessed by authenticated users. Next tutorial: **Creating a Logout Page**. # Creating a Logout Page In the previous tutorial, you protected pages so that only logged-in users could access them. In this tutorial, you will create a logout page that destroys the user's session and returns them to the login page. --- ## Why Do We Need Logout? When a user logs in, their information is stored in a PHP session. For example: ```text user_id = 1 username = admin ``` To completely sign the user out, we need to remove this session information. --- ## Create the Logout Page Create a new file called: ```text logout.php ``` Add the following code: ```php ``` Save the file. --- ## Understanding the Code The following line starts the current session: ```php session_start(); ``` The following line removes all session data: ```php session_destroy(); ``` Finally, the user is redirected back to the login page: ```php header("Location: login.php"); exit(); ``` --- ## Test the Logout Page First, log in to your application. You should be redirected to: ```text http://localhost/members.php ``` Now manually visit: ```text http://localhost/logout.php ``` You should immediately be redirected to: ```text http://localhost/login.php ``` ## Verify the Session Has Been Removed After visiting: ```text http://localhost/logout.php ``` attempt to access: ```text http://localhost/members.php ``` You should no longer have access. Instead, you should be redirected back to: ```text http://localhost/login.php ``` This confirms that the session was successfully destroyed. ## Add a Logout Link Open: ```text members.php ``` Add the following code near the bottom of the page: ```html ``` Example: ```phpWelcome,
User ID:
``` Save the file. --- ## Test the Logout Link 1. Log in. 2. Open the Members Area. 3. Click the Logout link. 4. Confirm you are returned to the login page. 5. Attempt to revisit members.php. You should be redirected back to the login page. ## Complete logout.php File ```php ``` --- ## Complete Updated members.php File ```phpWelcome,
User ID:
``` You now have a complete authentication system that allows users to: * Register an account * Log in * Stay logged in using sessions * Access protected pages * Log out Next tutorial: **Adding Role-Based Access Control (Admin, Teacher and Student Accounts)**. # Adding Role-Based Access Control In the previous tutorials, users could register, log in, access protected pages and log out. In this tutorial, you will add roles to your user accounts and restrict access to pages based on those roles. The system will support three roles: ```text admin teacher student ``` --- ## Add a Role Column to the Users Table Open phpMyAdmin and select your `project_db` database. Run the following SQL statement: ```sql ALTER TABLE users ADD role VARCHAR(20) NOT NULL DEFAULT 'student'; ``` This creates a new field called `role` and automatically assigns the value `student` to any existing or future users. ## Check the Updated Table Run: ```sql SELECT * FROM users; ``` You should now see a role column. Example: | user_id | username | password | role | | ------- | -------- | ---------- | ------- | | 1 | admin | $2y$10$... | student | | 2 | teacher | $2y$10$... | student | ## Update Existing Users Update the admin account: ```sql UPDATE users SET role = 'admin' WHERE username = 'admin'; ``` Update the teacher account: ```sql UPDATE users SET role = 'teacher' WHERE username = 'teacher'; ``` Run: ```sql SELECT * FROM users; ``` Example: | user_id | username | role | | ------- | -------- | ------- | | 1 | admin | admin | | 2 | teacher | teacher | | 3 | testuser | student | [](https://mr.napper.au/uploads/images/gallery/2026-06/image-1780909123223.png) ## Store the User Role in the Session Open: ```text login.php ``` Locate: ```php $_SESSION["user_id"] = $user["user_id"]; $_SESSION["username"] = $user["username"]; ``` Add: ```php $_SESSION["role"] = $user["role"]; ``` The completed section should look like: ```php $_SESSION["user_id"] = $user["user_id"]; $_SESSION["username"] = $user["username"]; $_SESSION["role"] = $user["role"]; header("Location: members.php"); exit(); ``` This stores the user's role when they log in. --- ## Display the User Role Open: ```text members.php ``` Add: ```phpRole:
``` Example: ```phpWelcome,
Role:
``` Save the file and log in. Example result: ```text Welcome, admin Role: admin ``` ## Create an Admin Page Create a new file called: ```text admin.php ``` Add the following code: ```phpWelcome,
``` Save the file. --- ## Test Admin Access Log in as: ```text admin ``` Visit: ```text http://localhost/admin.php ``` The page should load successfully. ## Test Non-Admin Access Log out. Log in as: ```text teacher ``` or ```text student ``` Visit: ```text http://localhost/admin.php ``` You should see: ```text Access denied. ``` ## Add an Admin Link Open: ```text members.php ``` Add: ```php ``` Example: ```php ``` Now only administrators will see the Admin Area link. --- ## Complete SQL Commands ```sql ALTER TABLE users ADD role VARCHAR(20) NOT NULL DEFAULT 'student'; UPDATE users SET role = 'admin' WHERE username = 'admin'; UPDATE users SET role = 'teacher' WHERE username = 'teacher'; SELECT * FROM users; ``` --- ## Complete Role Storage Code ```php $_SESSION["user_id"] = $user["user_id"]; $_SESSION["username"] = $user["username"]; $_SESSION["role"] = $user["role"]; header("Location: members.php"); exit(); ``` You now have a role-based access system that supports: * Admin users * Teacher users * Student users You can use the same technique to create protected pages for different user groups. Next tutorial: **Creating a Navigation Menu Based on User Roles**. # Creating a Navigation Menu Based on User Roles In the previous tutorial, you created a role-based access control system using admin, teacher and student accounts. In this tutorial, you will build a navigation menu that changes depending on the role of the logged-in user. This allows different users to see different menu options. --- ## Current Situation At the moment, every user sees the same page after logging in. Example: ```text Welcome, admin Role: admin Logout ``` We can improve this by displaying different navigation links based on the user's role. --- ## Create a Navigation Section Open: ```text members.php ``` Add the following code underneath the welcome message: ```phpWelcome,
``` Save the file. --- ## Add a Teacher Link Add the following code to your navigation menu: ```phpWelcome,
``` Save the file. --- ## Add a Student Link Add: ```php