A Login System with Sessionsسیستەمی چوونەژوورەوە بە سێشن

CREATE DATABASE session;
USE session;

CREATE TABLE users (
    id       INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50)  NOT NULL,
    email    VARCHAR(100) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL
);

<?php

$connect= mysqli_connect('localhost', 'root','root' );
if(!$connect){
    die("could not connect".mysqli_error($connect));

}
$db= mysqli_select_db($connect, 'session');
if(!$db){
    die("could not select database".mysqli_error($connect));
}

<?php
    $connect = mysqli_connect('localhost', 'root', '', 'session');
    if (!$connect) {
        die("Cannot connect to the db: ".mysqli_error($connect));
    }
?>

<?php
// connection.php: the database connection, included by the other pages.
// Since PHP 8.1, mysqli throws an exception when something fails. We say so clearly:
mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

try {
    // server, MySQL user, password, database name (XAMPP: user "root", empty password)
    $connect = mysqli_connect('localhost', 'root', '', 'session');
    mysqli_set_charset($connect, 'utf8mb4');
} catch (mysqli_sql_exception $e) {
    // Do not show technical details to visitors
    die('Cannot connect to the database. Is MySQL running?');
}

<html>
   <head>
     <meta charset="UTF-8">
     <title></title>
   </head>
   <body>
     <form align="center" method="post" action="<?php echo
         htmlspecialchars($_SERVER["PHP_SELF"]) ?>">
        Username: <input type="text" name="uname" size="30"><br><br>  Email:
        <input type="text" name="email" size="30"><br><br>  Password: <input
        type="password" name="pass1" size="30"><br><br>  Username: <input
        type="password" name="pass2" size="30"><br><br>
        <input type="submit" value="Create Account" name="submit"><br>
       <?php
         if(isset($_POST["submit"])){
              if(empty($_POST["uname"])){
                 echo "Username is required";
              }elseif(empty($_POST["email"])) {
                 echo"Please enter your email address";
              }elseif(empty($_POST["pass1"])) {
                 echo"Please enter your password";
              }elseif(empty($_POST["pass2"])) {
                 echo"Please confirm your password";
              }elseif($_POST["pass1"]!=$_POST["pass2"]) {
                 echo" passwords didnot match, please try again";
              }else{
                    //getting values from form inputs
                 $name=$_POST["uname"];
                 $email=$_POST["email"];
                 $password=$_POST["pass1"];
                 $password= sha1($password);
                 require './connection.php';
                 $query="INSERT INTO Users (name, email, password) VALUES ('$name', '$email',
'$password')";
                 $result= mysqli_query ($connect, $query);
                    //check the query if it's true
                 if($result){
                     echo "Account created succeffuly, you can login now";
                 }else{
                     echo"error occured, please try again".mysql_error();
                 }
                 //close the connecton
                 mysqli_close($connect);
            }
          }

       ?>
     </form>

<?php
    include('connection.php');

    if (isset($_POST['confirmBtn']))
    {
        $username = $_POST['usernameInput'];
        $email = $_POST['emailInput'];
        $address = $_POST['addressInput'];
        $password = $_POST['passwordInput'];
        $query = mysqli_query($connect, "insert into Users (username, email, password) values ('$username', '$email', '$password')");
        if ($query)
        {
            echo "Account created successfully!";
        } else {
            echo "An error has been occured!".mysqli_error($connect);
        }
    }
?>

<html>
    <body>
        <form method="POST">
            Username: <input type="text" name="usernameInput"><br>
            Email Address: <input type="text" name="emailInput"><br>
            Password: <input type="text" name="passwordInput"><br>
            <input type="submit" name="confirmBtn" value="Create Account">
        </form>
    </body>
</html>

<?php
require 'connection.php';

$message  = '';
$username = '';
$email    = '';

if (isset($_POST['confirmBtn'])) {
    // Read the form values (?? '' avoids warnings if a field is missing)
    $username = trim($_POST['usernameInput'] ?? '');
    $email    = trim($_POST['emailInput'] ?? '');
    $password = $_POST['passwordInput'] ?? '';
    $confirm  = $_POST['confirmInput'] ?? '';

    // Check the inputs in order, like the lab does
    if ($username === '') {
        $message = 'Username is required.';
    } elseif ($email === '') {
        $message = 'Please enter your email address.';
    } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        $message = 'Please enter a valid email address.';
    } elseif ($password === '') {
        $message = 'Please enter your password.';
    } elseif (strlen($password) < 8) {
        $message = 'The password needs at least 8 characters.';
    } elseif ($confirm === '') {
        $message = 'Please confirm your password.';
    } elseif ($password !== $confirm) {
        $message = 'The passwords did not match. Please try again.';
    } else {
        // Never store the password itself: store a slow, salted hash
        $hash = password_hash($password, PASSWORD_DEFAULT);

        // Prepared statement: the ? marks are filled in safely (no SQL injection)
        $stmt = mysqli_prepare($connect, 'INSERT INTO users (username, email, password) VALUES (?, ?, ?)');
        mysqli_stmt_bind_param($stmt, 'sss', $username, $email, $hash);
        try {
            mysqli_stmt_execute($stmt);
            $message  = 'Account created successfully. You can log in now.';
            $username = '';
            $email    = '';
        } catch (mysqli_sql_exception $e) {
            // Error 1062 = duplicate entry: the email column is UNIQUE
            if ($e->getCode() === 1062) {
                $message = 'An account with this email already exists.';
            } else {
                $message = 'An error occurred. Please try again.';
            }
        }
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Create an account</title>
</head>
<body>
    <h1>Create an account</h1>
    <p><?php echo htmlspecialchars($message); ?></p>
    <form method="post">
        Username: <input type="text" name="usernameInput" value="<?php echo htmlspecialchars($username); ?>"><br>
        Email Address: <input type="email" name="emailInput" value="<?php echo htmlspecialchars($email); ?>"><br>
        Password: <input type="password" name="passwordInput"><br>
        Confirm Password: <input type="password" name="confirmInput"><br>
        <input type="submit" name="confirmBtn" value="Create Account">
    </form>
    <p>Already have an account? <a href="login.php">Log in</a></p>
</body>
</html>

<?php
$password = 'tea-and-bread-42';

$hash1 = password_hash($password, PASSWORD_DEFAULT);
$hash2 = password_hash($password, PASSWORD_DEFAULT);
echo $hash1 . "<br>";
echo $hash2 . "<br>";                                  // different: each hash has its own random salt

var_dump(password_verify('tea-and-bread-42', $hash1)); // the right password
var_dump(password_verify('Tea-and-bread-42', $hash1)); // one letter is different

$result= mysqli_query ($connect, $query);
         $num_row=mysqli_num_rows($result);
         //check the row number is equal to 1, so we founded matched user
      if($num_row==1){
               //fetch user information and put them in array
               $row=mysqli_fetch_array($result, MYSQLI_ASSOC);
               //HERE YOU CREATE SESSION OR COOKIE


      }

$result= mysqli_query ($connect, $query);
         $num_row=mysqli_num_rows($result);
         //check the the row number is equal to 1, so we found matched user
      if($num_row==1){
               //fetch user information and put them in array
               $row=mysqli_fetch_array($result, MYSQLI_ASSOC);
               //HERE YOU CREATE SESSION OR COOKIE
                     session_start();
                     $_SESSION[‘user_id’]=$row[‘id’];
                     header(‘Location: index.php’);
                     exit();


      }

if (password_verify($password, $row['password'])) {
    // HERE WE CREATE THE SESSION
    session_regenerate_id(true);          // new session id after login
    $_SESSION['user_id']  = $row['id'];
    $_SESSION['username'] = $row['username'];
    header('Location: index.php');
    exit;                                 // stop: nothing else may run
}

<html>
   <head>
     <meta charset="UTF-8">
     <title></title>
   </head>
   <body>
     <form align="center" method="post" action="<?php echo
         htmlspecialchars($_SERVER["PHP_SELF"]) ?>">
         Email: <input type="text" name="email" size="30"><br><br>  Password:
        <input type="password" name="pass1" size="30"><br><br>
        <input type="submit" value="login" name="submit"><br>
       <?php
         if(isset($_POST["submit"])){
                    if(empty($_POST["email"])) {
                 echo"Please enter your email address";
              }elseif(empty($_POST["pass1"])) {
                 echo"Please enter your password";
              } else{
                    //getting values from form inputs
                    $email=$_POST["email"];
                 $password=$_POST["pass1"];
                 $password= sha1($password);
                 require './connection.php';
                 $query="SELECT * FROM Users WHERE email='$email' AND password='$password'";
                 $result= mysqli_query ($connect, $query);
                    $num_row=mysqli_num_rows($result);
                    //check the the row number is equal to 1, so we found matched user
                 if($num_row==1){
                              //fetch user information and put them in array
                              $row=mysqli_fetch_array($result, MYSQLI_ASSOC);
                              //HERE YOU CREATE SESSION OR COOKIE
                                        session_start();
                                        $_SESSION[‘user_id’] = $row[‘id’];
                                        header(‘Location: index.php’);
                                        exit();
                              }else{
                     echo"error occured, please try again".mysql_error();
                 }
                 //close the connecton
                 mysqli_close($connect);
            }
          }

       ?>
     </form>

<?php

    include('connection.php');

    if (isset($_POST['loginBtn']))
    {
        $email = $_POST['emailInput'];
        $password = $_POST['passwordInput'];
        $query = "SELECT * FROM Users WHERE email='$email' AND password='$password'";
        $result = mysqli_query ($connect, $query);

        while ($row = mysqli_fetch_assoc($result))
        {
            //HERE YOU CREATE SESSION OR COOKIE
            session_start();
            $_SESSION['user_id'] = $row['id'];

            //setcookie('user_id', $row['id'], time() + 50, "/index.php");

            header('Location:index.php');
            exit();
        }
    }
?>

<html>
    <body>
        <form method="post">
            Email: <input type="text" name="emailInput"><br>
            Password: <input type="text" name="passwordInput"><br>
            <input type="submit" name="loginBtn" value="Login">
        </form>
    </body>
</html>

<!DOCTYPE html>
<html lang="en">

<body>
    <?php
    include("config.php");

    if (isset($_POST['Login'])){

        $username = $_POST['user'];
        $password= md5($_POST['pass']);

        $selectQuery = mysqli_query($connection,"select * from users where username ='$username' and password = '$password' ");

        if (mysqli_num_rows($selectQuery)){
            while ($row = mysqli_fetch_assoc($selectQuery)){

            session_start();

            $_SESSION['userId'] = $row['id'];

            $_SESSION['userInput'] = $row['username'];

            header('location: view.php');
            exit();

            }
        }else{
            echo "username or password failed.";
        }
    }


    ?>

    <form method="post">
        username : <input type="text" name="user"><br><br>
        password : <input type="password" name="pass"><br><br>
        <input type="submit" name="Login" value="Login">



    </form>
</body>

</html>

<?php
// A small users table in memory (SQLite), only to show the attack
$db = new PDO('sqlite::memory:');
$db->exec("CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT, email TEXT, password TEXT)");
$db->exec("INSERT INTO users (username, email, password) VALUES
           ('admin', 'admin@example.com', 'k8#Lq2!z'),
           ('Aram',  'aram@example.com',  'tea-and-bread-42')");

// What an attacker types into the Email box (the password does not matter)
$email    = "x' OR '1'='1' -- ";
$password = "anything";

// UNSAFE: the input becomes part of the SQL text (like the lab's login.php)
$query = "SELECT * FROM users WHERE email='$email' AND password='$password'";
echo $query . "\n";
$rows = $db->query($query)->fetchAll(PDO::FETCH_ASSOC);
echo "Rows found: " . count($rows) . ", logged in as: " . $rows[0]['username'] . "\n";

// SAFE: a prepared statement keeps the input as data only
$stmt = $db->prepare("SELECT * FROM users WHERE email = ?");
$stmt->execute([$email]);
echo "Prepared statement, rows found: " . count($stmt->fetchAll()) . "\n";

<?php
$db = new PDO('sqlite::memory:');
$db->exec("CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT, password TEXT)");
$db->exec("INSERT INTO users (username, password) VALUES ('admin', '" . md5('k8#Lq2!z') . "')");
$username = "admin' -- ";
$password = md5("I do not know it");
$query = "select * from users where username ='$username' and password = '$password' ";
echo $query . "\n";
$rows = $db->query($query)->fetchAll(PDO::FETCH_ASSOC);
echo "Rows found: " . count($rows) . ", logged in as: " . $rows[0]['username'] . "\n";

<?php
session_start();              // before any output
require 'connection.php';

// Already logged in? Go straight to the protected page.
if (isset($_SESSION['user_id'])) {
    header('Location: index.php');
    exit;
}

$message = '';

if (isset($_POST['loginBtn'])) {
    $email    = trim($_POST['emailInput'] ?? '');
    $password = $_POST['passwordInput'] ?? '';

    if ($email === '') {
        $message = 'Please enter your email address.';
    } elseif ($password === '') {
        $message = 'Please enter your password.';
    } else {
        // Find the user by email only; the password is checked in PHP below
        $stmt = mysqli_prepare($connect, 'SELECT id, username, password FROM users WHERE email = ?');
        mysqli_stmt_bind_param($stmt, 's', $email);
        mysqli_stmt_execute($stmt);
        $result = mysqli_stmt_get_result($stmt);

        // Exactly one row: a user with this email exists (email is UNIQUE)
        if (mysqli_num_rows($result) === 1) {
            $row = mysqli_fetch_array($result, MYSQLI_ASSOC);   // the row as an associative array

            if (password_verify($password, $row['password'])) {
                // HERE WE CREATE THE SESSION
                session_regenerate_id(true);          // new session id after login
                $_SESSION['user_id']  = $row['id'];
                $_SESSION['username'] = $row['username'];
                header('Location: index.php');
                exit;                                 // stop: nothing else may run
            }
        }
        // One message for "unknown email" and "wrong password"
        $message = 'Wrong email or password.';
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Log in</title>
</head>
<body>
    <h1>Log in</h1>
    <p><?php echo htmlspecialchars($message); ?></p>
    <form method="post">
        Email: <input type="email" name="emailInput"><br>
        Password: <input type="password" name="passwordInput"><br>
        <input type="submit" name="loginBtn" value="Login">
    </form>
    <p>No account yet? <a href="register.php">Create one</a></p>
</body>
</html>

         Session_start();
If(! isset($_SESSION[‘user_id’])){
         Header(‘Location:login.php’);
}

<? Php
        Session_start();
        If(! isset($_SESSION[‘user_id’])){
        Header(‘Location:login.php’);
}

echo “<h1> Welcome to website</h1>”;




?>

<?php
    session_start();
    if(!isset($_SESSION['user_id'])){
        header('Location: login.php');
    }
    echo "<h1>Welcome to website</h1>";

    echo "<a href='logout.php'>Logout</a>";
?>

<?php
session_start();

// Not logged in? Send the visitor to the login page and STOP the script.
if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Home</title>
</head>
<body>
    <h1>Welcome to the website, <?php echo htmlspecialchars($_SESSION['username']); ?>!</h1>
    <p><a href="logout.php">Logout</a></p>
</body>
</html>

<?php
// auth.php: require this file at the very top of every protected page
session_start();

if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

<?php
require 'auth.php';   // only logged-in users get past this line
?>
<!DOCTYPE html>
<html>
<body>
    <h1>Your profile</h1>
    <p>You are logged in as <?php echo htmlspecialchars($_SESSION['username']); ?>.</p>
</body>
</html>

<?php
 session_start();
//clear session variable
unset($_SESSION["user_id"]);
//destroy session on the server
session_destroy();
//redirect user to login page
header("Location: login.php");

<?php


session_start();

session_unset();

session_destroy();

header('location: login.php');



?>

<?php
session_start();                 // open the current session so that we can end it

$_SESSION = [];                  // 1. remove all session variables

// 2. delete the session cookie in the browser (same name, path and domain; time in the past)
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
    $params['path'], $params['domain'], $params['secure'], $params['httponly']);

session_destroy();               // 3. delete the session data on the server

header('Location: login.php');   // 4. back to the login page
exit;

// time()+3600 set cookie for one hour
setcookie ('user_id', $row ['id'], time()+3600,     '/', '', 0,
0);

if (!isset($_COOKIE['user_id'])) {
//redirect user to login page
header(“Location: login.php”)
}

//check for cookie is not set then redirect to login.php page
if (!isset($_COOKIE['user_id'])) {

         header(“Location: login.php”);


} else {

 // Delete the cookies:

setcookie ('user_id', ' ', time()-3600, '/', '', 0, 0);

}

// UNSAFE (Lab 9 cookie version, for learning only): anyone can create this cookie by hand
setcookie('user_id', $row['id'], time() + 3600, '/', '', false, true);

<?php
// Lab 9 cookie version (UNSAFE, for learning only): it only checks that a cookie exists
if (!isset($_COOKIE['user_id'])) {
    header('Location: login.php');   // redirect user to login page
    exit;
}
echo "<h1>Welcome! You are logged in as user number " . htmlspecialchars($_COOKIE['user_id']) . ".</h1>";

<?php
// Lab 9 cookie version (UNSAFE, for learning only)
// check for the cookie: if it is not set, go to the login page
if (!isset($_COOKIE['user_id'])) {
    header('Location: login.php');
    exit;
}

// Delete the cookie: same name, path and domain as setcookie() used, empty value, time in the past
setcookie('user_id', '', time() - 3600, '/', '', false, true);
header('Location: login.php');
exit;

GET /index.php HTTP/1.1
Host: localhost
Cookie: user_id=1

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8

<h1>Welcome! You are logged in as user number 1.</h1>

include 'connection.php';
if (isset($_POST['LoginButton']))
{
    $username = $_POST['usernameInput'];
    $password = $_POST['passwordInput'];
    $adminOrUser = $_POST['AdminOrUserRadio'];
    $selectQuery = mysqli_query($connect, "select * from UserManagementTable where Username='$username' and Password='$password' and AdminOrUser='$adminOrUser'"   // (the line is cut off in the screenshot)

    while ($row = mysqli_fetch_assoc($selectQuery))
    {
        if ($selectQuery)
        {
            if ($row['AdminOrUser'] == "Admin")
            {
                //If admin logged in
                //echo "Admin with the username of $username and password of $password has logged in.";

                // setcookie("user_id", $row['UserID'], time() + 1000);
                // setcookie("username", $row['Username'], time() + 1000);

                session_start();
                $_SESSION["user_id"] = $row['UserID'];
                $_SESSION["username"] = $row['Username'];

                header('Location: usermanagement.php');
                exit();
            }
            else if ($row['AdminOrUser'] == "User")
            {
                //If user logged in
                echo "A user with the username of $username and password of $password has logged in.";
            }

ALTER TABLE users ADD role VARCHAR(10) NOT NULL DEFAULT 'user';

-- make one account an administrator
UPDATE users SET role = 'admin' WHERE email = 'shilan@example.com';

if (password_verify($password, $row['password'])) {
    session_regenerate_id(true);
    $_SESSION['user_id']  = $row['id'];
    $_SESSION['username'] = $row['username'];
    $_SESSION['role']     = $row['role'];     // from the database, not from the form

    if ($row['role'] === 'admin') {
        header('Location: usermanagement.php');
    } else {
        header('Location: index.php');
    }
    exit;
}

<?php
session_start();

// 1. Authentication: is anybody logged in?
if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

// 2. Authorization: is this user allowed to see this page?
if (($_SESSION['role'] ?? '') !== 'admin') {
    http_response_code(403);   // 403 = Forbidden
    exit('Only administrators can open this page.');
}
?>
<!DOCTYPE html>
<html>
<body>
    <h1>User management</h1>
    <p>Welcome, administrator <?php echo htmlspecialchars($_SESSION['username']); ?>.</p>
</body>
</html>