# Creating a Login Form
This standalone login page validates credentials with PDO, starts a secure session and redirects authenticated users. It uses one generic failure message so it does not reveal whether a username exists.
## Login page
~~~php
prepare(
"SELECT user_id, username, password, role
FROM users
WHERE username = :username"
);
$stmt->execute(["username" => $username]);
$user = $stmt->fetch();
if ($user && password_verify($password, $user["password"])) {
session_regenerate_id(true);
$_SESSION["user_id"] = (int) $user["user_id"];
$_SESSION["username"] = $user["username"];
$_SESSION["role"] = $user["role"];
header("Location: dashboard.php");
exit;
}
$error = "Username or password was not accepted.";
}
?>
Log in
Log in
~~~
## Why the security steps matter
- prepared statements keep input separate from SQL
- `password_verify()` checks the stored hash
- session ID regeneration reduces session fixation risk
- role comes from the database, not the form
- a generic error reduces account discovery
## Test
Test a valid standard user, a valid administrator, a wrong password, an unknown username and empty fields. Confirm that failed attempts do not create session identity values.
## Check
- [ ] Session starts before output.
- [ ] Query uses a prepared statement.
- [ ] Password hash is verified correctly.
- [ ] Session ID changes after login.
- [ ] User ID, username and role are stored.
- [ ] Failure message is generic.