Creating a Login Form

In the previous tutorial, you created a registration form that stores users in the database. In this tutorial, you will create a login form that checks a username and password against the database and allows a user to log in.

Create the Login Page

Create a new file called:

login.php

Add the following code:

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>

<h1>Login</h1>

<form action="login.php" method="post">

    <label>Username</label><br>
    <input type="text" name="username" required><br><br>

    <label>Password</label><br>
    <input type="password" name="password" required><br><br>

    <button type="submit">Login</button>

</form>

</body>
</html>

Save the file and open it in your browser.

Example:

http://localhost/login.php

Connect to the Database

Add the following code above the <!DOCTYPE html> line:

<?php

$conn = new mysqli(
    "localhost",
    "root",
    "",
    "project_db"
);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

?>

This creates a connection to the database.

Process the Login Form

Add the following code underneath the database connection:

if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $username = $_POST["username"];
    $password = $_POST["password"];

}

This code will run when the form is submitted.

Find the User

Inside the if statement, add:

$stmt = $conn->prepare(
    "SELECT * FROM users
     WHERE username = ?"
);

$stmt->bind_param(
    "s",
    $username
);

$stmt->execute();

$result = $stmt->get_result();

This searches the database for the username entered on the form.

Check if the User Exists

Add:

if ($result->num_rows == 1) {

    $user = $result->fetch_assoc();

}
else {

    echo "<p>User not found.</p>";

}

If the username exists, the user's record is loaded from the database.

Verify the Password

Inside the successful login section, add:

if (
    password_verify(
        $password,
        $user["password"]
    )
) {

    echo "<p>Login successful.</p>";

}
else {

    echo "<p>Incorrect password.</p>";

}

This compares the entered password against the stored password hash.

Complete Login Logic

Your completed login section should look like:

if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $username = $_POST["username"];
    $password = $_POST["password"];

    $stmt = $conn->prepare(
        "SELECT * FROM users
         WHERE username = ?"
    );

    $stmt->bind_param(
        "s",
        $username
    );

    $stmt->execute();

    $result = $stmt->get_result();

    if ($result->num_rows == 1) {

        $user = $result->fetch_assoc();

        if (
            password_verify(
                $password,
                $user["password"]
            )
        ) {

            echo "<p>Login successful.</p>";

        }
        else {

            echo "<p>Incorrect password.</p>";

        }

    }
    else {

        echo "<p>User not found.</p>";

    }

}

Test a Successful Login

Open:

http://localhost/login.php

Enter a username and password that already exist in the database.

Example:

Username: admin
Password: password123

Click Login.

You should see:

Login successful.

Test an Incorrect Password

Enter:

Username: admin
Password: wrongpassword

Click Login.

You should see:

Incorrect password.

Test an Unknown User

Enter:

Username: unknownuser
Password: password123

Click Login.

You should see:

User not found.

Complete Code

<?php

$conn = new mysqli(
    "localhost",
    "root",
    "",
    "project_db"
);

if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {

    $username = $_POST["username"];
    $password = $_POST["password"];

    $stmt = $conn->prepare(
        "SELECT * FROM users
         WHERE username = ?"
    );

    $stmt->bind_param(
        "s",
        $username
    );

    $stmt->execute();

    $result = $stmt->get_result();

    if ($result->num_rows == 1) {

        $user = $result->fetch_assoc();

        if (
            password_verify(
                $password,
                $user["password"]
            )
        ) {

            echo "<p>Login successful.</p>";

        }
        else {

            echo "<p>Incorrect password.</p>";

        }

    }
    else {

        echo "<p>User not found.</p>";

    }

}

?>

<!DOCTYPE html>
<html>
<head>
    <title>Login</title>
</head>
<body>

<h1>Login</h1>

<form action="login.php" method="post">

    <label>Username</label><br>
    <input type="text" name="username" required><br><br>

    <label>Password</label><br>
    <input type="password" name="password" required><br><br>

    <button type="submit">Login</button>

</form>

</body>
</html>

You now have a working login form that validates usernames and passwords against your database.

Next tutorial: Using PHP Sessions to Keep Users Logged In.

Revision #1
Created 2026-06-08 04:50:20 UTC by Mr Napper
Updated 2026-06-08 04:54:33 UTC by Mr Napper