PHP Login and Registration System (Full Code)

What we are building

A login system has four parts: a users table, registration (create an account), login (verify and start a session), and logout. Throughout, passwords are hashed and queries use prepared statements. This is the standard, secure pattern every real site follows.

The users table

CREATE TABLE users (
    id       INT AUTO_INCREMENT PRIMARY KEY,
    email    VARCHAR(80) UNIQUE NOT NULL,
    password VARCHAR(255) NOT NULL
);

The UNIQUE email stops duplicate accounts. The password column is long (255) because a hash is much longer than the original password.

Registration

<?php
  $email = trim($_POST["email"]);
  $pass  = $_POST["password"];
  $hash  = password_hash($pass, PASSWORD_DEFAULT);

  $sql = "INSERT INTO users (email, password) VALUES (?, ?)";
  $stmt = $pdo->prepare($sql);
  $stmt->execute([$email, $hash]);
  echo "Account created";
?>

The password is hashed before saving, and the query uses placeholders. The database never sees the real password.

Login

<?php
  session_start();
  $email = trim($_POST["email"]);
  $pass  = $_POST["password"];

  $stmt = $pdo->prepare("SELECT id, password FROM users WHERE email = ?");
  $stmt->execute([$email]);
  $user = $stmt->fetch(PDO::FETCH_ASSOC);

  if ($user && password_verify($pass, $user["password"])) {
      $_SESSION["user_id"] = $user["id"];
      echo "Login success";
  } else {
      echo "Invalid email or password";
  }
?>

We look up the user by email, then password_verify checks the password against the stored hash. On success we save the user id in the session.

Protecting a page

<?php
  session_start();
  if (empty($_SESSION["user_id"])) {
      header("Location: login.php");
      exit;
  }
  echo "Welcome to your dashboard";
?>

Every page that needs a logged-in user checks the session first. If there is no user_id, it redirects to the login page.

Logout

<?php
  session_start();
  session_unset();
  session_destroy();
  header("Location: login.php");
?>

Logging out clears the session so the user is no longer recognised, then sends them back to the login page.

Common mistakes

• Storing plain passwords. Always password_hash on register, password_verify on login.
• Building SQL with input. Use prepared statements to block injection.
• No UNIQUE email. Duplicate accounts slip in without it.
• Not checking the session on protected pages. Anyone could open them directly.

Summary

• A login system = users table + register + login + logout.
• Hash passwords with password_hash; check with password_verify.
• Store login state in a session; check it on every protected page.
• Use prepared statements for all database queries.
• Make the email column UNIQUE to prevent duplicates.

Next, understand hashing in depth with password hashing, or manage state with sessions and cookies.